diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py index 3787603dd6..0b1a6ba2fd 100644 --- a/prowler/lib/check/models.py +++ b/prowler/lib/check/models.py @@ -528,11 +528,17 @@ class Check_Report_Kubernetes(Check_Report): resource_id: str namespace: str - def __init__(self, metadata): - super().__init__(metadata) - self.resource_name = "" - self.resource_id = "" - self.namespace = "" + def __init__(self, metadata, resource_metadata): + super().__init__(metadata, resource_metadata) + self.resource_id = ( + getattr(resource_metadata, "uid", None) + or getattr(resource_metadata, "name", None) + or "" + ) + self.resource_name = getattr(resource_metadata, "name", "") + self.namespace = getattr(resource_metadata, "namespace", "cluster-wide") + if not self.namespace: + self.namespace = "cluster-wide" # Testing Pending diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.py b/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.py index f75d7a16b2..567ae7a317 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.py @@ -8,10 +8,9 @@ class apiserver_always_pull_images_plugin(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"AlwaysPullImages admission control plugin is set in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.py b/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.py index 4bea8922fb..66db3ddc91 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.py @@ -8,17 +8,15 @@ class apiserver_anonymous_requests(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"API Server does not have anonymous-auth enabled in pod {pod.name}." ) for container in pod.containers.values(): if "--anonymous-auth=true" in container.command: - report.status = "FAIL" report.status_extended = ( f"API Server has anonymous-auth enabled in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.py index e19462a9ea..c4061b93fa 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.py @@ -8,10 +8,9 @@ class apiserver_audit_log_maxage_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Audit log max age is set appropriately in the API server in pod {pod.name}." audit_log_maxage_set = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.py index 6dcb3feef4..46e9ad99f7 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.py @@ -8,10 +8,9 @@ class apiserver_audit_log_maxbackup_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Audit log max backup is set appropriately in the API server in pod {pod.name}." audit_log_maxbackup_set = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.py index 7f11723b51..f7f14f9b6f 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.py @@ -8,10 +8,9 @@ class apiserver_audit_log_maxsize_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Audit log max size is set appropriately in the API server in pod {pod.name}." audit_log_maxsize_set = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.py index 779d9f565a..3f7cbb93bd 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.py @@ -8,10 +8,9 @@ class apiserver_audit_log_path_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Audit log path is set in the API server in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.py b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.py index d924f58826..84e60f10ba 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.py @@ -8,10 +8,9 @@ class apiserver_auth_mode_include_node(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"API Server authorization mode includes Node in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.py b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.py index 397dd69cc6..442051a71d 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.py @@ -8,10 +8,9 @@ class apiserver_auth_mode_include_rbac(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"API Server authorization mode includes RBAC in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.py b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.py index 2dac946f4a..8a8f53b8cc 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.py @@ -8,10 +8,9 @@ class apiserver_auth_mode_not_always_allow(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"API Server authorization mode is not set to AlwaysAllow in pod {pod.name}." always_allow_in_auth_mode = True diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.py index 2f825cc043..a90ae83e61 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.py @@ -8,10 +8,9 @@ class apiserver_client_ca_file_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Client CA file is set appropriately in the API server in pod {pod.name}." client_ca_file_set = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.py b/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.py index b2323bf641..7abd2ff5c5 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.py @@ -8,10 +8,9 @@ class apiserver_deny_service_external_ips(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"API Server has DenyServiceExternalIPs admission controller enabled in pod {pod.name}." deny_service_external_ips = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.py b/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.py index fcb16739b7..0942003752 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.py @@ -8,10 +8,9 @@ class apiserver_disable_profiling(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Profiling is disabled in pod {pod.name}." profiling_enabled = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.py index 8d78ea64b0..04621ad838 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.py @@ -8,10 +8,9 @@ class apiserver_encryption_provider_config_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Encryption provider config is set appropriately in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.py index bd4b65bf85..76035bfda3 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.py @@ -8,10 +8,9 @@ class apiserver_etcd_cafile_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"etcd CA file is set appropriately in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.py b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.py index 0597d5d82e..7a2479e307 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.py @@ -8,10 +8,9 @@ class apiserver_etcd_tls_config(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"TLS configuration for etcd is set appropriately in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.py b/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.py index 2e491dfcc0..0e8a1de81a 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.py @@ -8,10 +8,9 @@ class apiserver_event_rate_limit(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"EventRateLimit admission control plugin is set in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.py b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.py index c10c17c789..b725971199 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.py @@ -8,10 +8,9 @@ class apiserver_kubelet_cert_auth(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"API Server has appropriate kubelet certificate authority configured in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.py b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.py index f0ecb0f479..7baeb5946e 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.py @@ -8,17 +8,15 @@ class apiserver_kubelet_tls_auth(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"API Server has appropriate kubelet TLS authentication configured in pod {pod.name}." for container in pod.containers.values(): if "--kubelet-client-certificate" not in str( container.command ) and "--kubelet-client-key" not in str(container.command): - report.status = "FAIL" report.status_extended = f"API Server is missing kubelet TLS authentication arguments in pod {pod.name}." break diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.py b/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.py index 7c4d7b4a49..10e9427840 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.py @@ -8,10 +8,9 @@ class apiserver_namespace_lifecycle_plugin(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"NamespaceLifecycle admission control plugin is set in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.py b/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.py index 045a899145..987f900704 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.py @@ -8,10 +8,9 @@ class apiserver_no_always_admit_plugin(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"AlwaysAdmit admission control plugin is not set in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.py b/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.py index 81d0e84c8f..25a9f6d292 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.py @@ -8,10 +8,9 @@ class apiserver_no_token_auth_file(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"API Server does not have token-auth-file enabled in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.py b/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.py index 4a09ea6534..7529d677af 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.py @@ -8,10 +8,9 @@ class apiserver_node_restriction_plugin(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"NodeRestriction admission control plugin is set in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.py index 273b100eb3..8bf93d12b3 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.py @@ -8,10 +8,9 @@ class apiserver_request_timeout_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Request timeout is set appropriately in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.py b/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.py index e4a1e45f80..5abad9d71e 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.py @@ -8,10 +8,9 @@ class apiserver_security_context_deny_plugin(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) security_context_deny_set = False pod_security_policy_set = False for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.py b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.py index c6f580720e..d84c1c90fe 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.py @@ -8,10 +8,9 @@ class apiserver_service_account_key_file_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Service account key file is set appropriately in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.py b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.py index 0268136b2c..8b64d77be4 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.py @@ -8,10 +8,9 @@ class apiserver_service_account_lookup_true(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Service account lookup is set to true in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.py b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.py index 4a8c88576b..978da66e77 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.py @@ -8,10 +8,9 @@ class apiserver_service_account_plugin(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"ServiceAccount admission control plugin is set in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py index ddfa05ddde..5140d4ff87 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py @@ -14,10 +14,9 @@ class apiserver_strong_ciphers_only(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"API Server is configured with strong cryptographic ciphers in pod {pod.name}." strong_ciphers_set = False diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.py b/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.py index d159ab1766..2457d8f4e1 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.py @@ -8,10 +8,9 @@ class apiserver_tls_config(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in apiserver_client.apiserver_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"TLS certificate and key are set appropriately in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.py index 575928a135..a129c0c480 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.py @@ -8,10 +8,9 @@ class controllermanager_bind_address(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Controller Manager is bound to the loopback address in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.py index 8454dc1303..39c9825922 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.py @@ -8,10 +8,9 @@ class controllermanager_disable_profiling(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Controller Manager does not have profiling enabled in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.py index 1a20849198..4f03e17481 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.py @@ -8,10 +8,9 @@ class controllermanager_garbage_collection(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Controller Manager has an appropriate garbage collection threshold in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.py index 6f63dcfbf9..27577a5ec7 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.py @@ -8,10 +8,9 @@ class controllermanager_root_ca_file_set(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Controller Manager does not have the root CA file set in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.py index e18b4556af..ff1c97f300 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.py @@ -8,10 +8,9 @@ class controllermanager_rotate_kubelet_server_cert(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Controller Manager has RotateKubeletServerCertificate set to true in pod {pod.name}." kubelete_server_cert = True diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.py index 7e48a5f969..5513a8e439 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.py @@ -8,10 +8,9 @@ class controllermanager_service_account_credentials(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Controller Manager is not using service account credentials in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.py b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.py index 367a60d001..550d533c0e 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.py +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.py @@ -8,10 +8,9 @@ class controllermanager_service_account_private_key_file(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in controllermanager_client.controllermanager_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Controller Manager does not have the service account private key file set in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.py index 2c22a0a54d..ff15f26c4e 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.py @@ -6,10 +6,9 @@ class core_minimize_admission_hostport_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Pod {pod.name} does not use HostPorts." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.py index 9bbd99b108..95c9502db0 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.py @@ -6,10 +6,9 @@ class core_minimize_admission_windows_hostprocess_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Pod {pod.name} does not have the ability to run a Windows HostProcess." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.py index bc82a5e719..d0ef865881 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.py @@ -6,10 +6,9 @@ class core_minimize_allowPrivilegeEscalation_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Pod {pod.name} does not allow for privilege escalation." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.py b/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.py index 7ecb86042e..a802d9a5c3 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.py @@ -6,10 +6,9 @@ class core_minimize_containers_added_capabilities(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Pod {pod.name} does not have added capabilities." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.py b/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.py index 88a08e6355..d20689641f 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.py @@ -6,10 +6,9 @@ class core_minimize_containers_capabilities_assigned(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Pod {pod.name} without capabilities issues found." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.py index a1305ed262..c811f3e289 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.py @@ -6,10 +6,9 @@ class core_minimize_hostIPC_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) if pod.host_ipc: report.status = "FAIL" report.status_extended = f"Pod {pod.name} is using hostIPC." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.py index 7bae4ee063..4ca76676d0 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.py @@ -6,10 +6,9 @@ class core_minimize_hostNetwork_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) if pod.host_network: report.status = "FAIL" report.status_extended = f"Pod {pod.name} is using hostNetwork." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.py index 5f11ca7879..1ed74361d6 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.py @@ -6,10 +6,9 @@ class core_minimize_hostPID_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) if pod.host_pid: report.status = "FAIL" report.status_extended = f"Pod {pod.name} is using hostPID." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py index a6af15c1b2..4ef8cbe529 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py @@ -6,10 +6,9 @@ class core_minimize_net_raw_capability_admission(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Pod {pod.name} does not have NET_RAW capability." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.py b/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.py index 9da4971280..616b14cf29 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.py @@ -6,10 +6,9 @@ class core_minimize_privileged_containers(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Pod {pod.name} does not contain a privileged container." diff --git a/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.py b/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.py index 7ea5e31f42..b973f93868 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.py @@ -6,10 +6,9 @@ class core_minimize_root_containers_admission(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Pod {pod.name} is not running as root user." diff --git a/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.py b/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.py index 3d9ba471db..23af640083 100644 --- a/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.py +++ b/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.py @@ -6,10 +6,9 @@ class core_no_secrets_envs(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Pod {pod.name} does not contain any secret environment variables." diff --git a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py index 20a9c16b2f..2e54f41511 100644 --- a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py +++ b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py @@ -6,10 +6,9 @@ class core_seccomp_profile_docker_default(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in core_client.pods.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) pod_seccomp_correct = ( pod.security_context diff --git a/prowler/providers/kubernetes/services/core/core_service.py b/prowler/providers/kubernetes/services/core/core_service.py index 42c7d85376..3d100fb739 100644 --- a/prowler/providers/kubernetes/services/core/core_service.py +++ b/prowler/providers/kubernetes/services/core/core_service.py @@ -1,8 +1,6 @@ import socket -from dataclasses import dataclass -from typing import List, Optional +from typing import Any, List, Optional -from kubernetes.client.models import V1PodSecurityContext, V1SecurityContext from pydantic import BaseModel from kubernetes import client @@ -143,18 +141,16 @@ class Core(KubernetesService): ) -@dataclass -class Container: +class Container(BaseModel): name: str image: str command: Optional[List[str]] ports: Optional[List[dict]] env: Optional[List[dict]] - security_context: Optional[V1SecurityContext] + security_context: Any -@dataclass -class Pod: +class Pod(BaseModel): name: str uid: str namespace: str @@ -168,7 +164,7 @@ class Pod: host_pid: Optional[str] host_ipc: Optional[str] host_network: Optional[str] - security_context: Optional[V1PodSecurityContext] + security_context: Any containers: Optional[dict] diff --git a/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.py b/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.py index f4d217ac62..7a41da8fab 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.py @@ -6,10 +6,9 @@ class etcd_client_cert_auth(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in etcd_client.etcd_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Etcd has client certificate authentication enabled in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.py b/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.py index 1149f5bcae..9c671510a2 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.py @@ -6,10 +6,9 @@ class etcd_no_auto_tls(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in etcd_client.etcd_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Etcd is not configured to use self-signed certificates for TLS in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.py b/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.py index 336f8b64b8..b6cab8fea9 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.py @@ -6,10 +6,9 @@ class etcd_no_peer_auto_tls(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in etcd_client.etcd_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Etcd is not using automatically generated self-signed certificates for peer TLS connections in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.py b/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.py index 5a3ba8d76f..f416fba189 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.py @@ -6,10 +6,9 @@ class etcd_peer_client_cert_auth(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in etcd_client.etcd_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = f"Etcd is configured for peer client certificate authentication in pod {pod.name}." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.py b/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.py index 500c45e8ee..1c2f5bd421 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.py @@ -6,10 +6,9 @@ class etcd_peer_tls_config(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in etcd_client.etcd_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Etcd is configured with TLS for peer connections in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.py b/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.py index 07f04e34d5..6686366dde 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.py @@ -6,10 +6,9 @@ class etcd_tls_encryption(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in etcd_client.etcd_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "FAIL" report.status_extended = ( f"Etcd does not have TLS encryption configured in pod {pod.name}." @@ -18,7 +17,6 @@ class etcd_tls_encryption(Check): if "--cert-file" in str(container.command) and "--key-file" in str( container.command ): - report.status = "PASS" report.status_extended = ( f"Etcd has configured TLS encryption in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.py b/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.py index 00ba015a96..3d05803259 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.py +++ b/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.py @@ -17,10 +17,9 @@ class etcd_unique_ca(Check): apiserver_ca_files.append(command.split("=")[1]) for pod in etcd_client.etcd_pods: etcd_ca_files = [] - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "MANUAL" report.status_extended = f"Etcd uses a different CA file from the Kubernetes cluster CA in pod {pod.name}, but verify if the content is the same." for container in pod.containers.values(): diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.py b/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.py index cf797aa170..517102f026 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.py @@ -7,10 +7,9 @@ class kubelet_authorization_mode(Check): findings = [] for cm in kubelet_client.kubelet_config_maps: authorization = cm.kubelet_args.get("authorization") - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if not authorization: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `readOnlyPort` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.py b/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.py index 2e96632b74..e777f8779f 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.py @@ -7,10 +7,9 @@ class kubelet_client_ca_file_set(Check): findings = [] for cm in kubelet_client.kubelet_config_maps: authentication = cm.kubelet_args.get("authentication") - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if not authentication: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `readOnlyPort` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.py b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.py index 148d49a2d9..5fbc0f33cb 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.py @@ -7,10 +7,9 @@ class kubelet_conf_file_ownership(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for node in core_client.nodes.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = node.namespace - report.resource_name = node.name - report.resource_id = node.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=node + ) # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one if node.inside: if is_owned_by_root("/etc/kubernetes/kubelet.conf") is None: diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.py b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.py index 13f7835da2..f8dbe72c4d 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.py @@ -7,10 +7,9 @@ class kubelet_conf_file_permissions(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for node in core_client.nodes.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = node.namespace - report.resource_name = node.name - report.resource_id = node.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=node + ) # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one if node.inside: if not get_file_permissions("/etc/kubernetes/kubelet.conf"): diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.py b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.py index 792090a306..79b30dd6fe 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.py @@ -7,10 +7,9 @@ class kubelet_config_yaml_ownership(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for node in core_client.nodes.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = node.namespace - report.resource_name = node.name - report.resource_id = node.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=node + ) # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one if node.inside: if is_owned_by_root("/var/lib/kubelet/config.yaml") is None: diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.py b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.py index 4a4d42505c..fde060027c 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.py @@ -7,10 +7,9 @@ class kubelet_config_yaml_permissions(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for node in core_client.nodes.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = node.namespace - report.resource_name = node.name - report.resource_id = node.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=node + ) # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one if node.inside: if not get_file_permissions("/var/lib/kubelet/config.yaml"): diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.py b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.py index e56bbbd649..9c32953f1a 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.py @@ -7,10 +7,9 @@ class kubelet_disable_anonymous_auth(Check): findings = [] for cm in kubelet_client.kubelet_config_maps: authentication = cm.kubelet_args.get("authentication", {}) - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) report.status = "FAIL" report.status_extended = ( f"Kubelet has anonymous access enabled in config file {cm.name}." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.py b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.py index d21a7c16d9..f135c2ec79 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.py @@ -6,10 +6,9 @@ class kubelet_disable_read_only_port(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if "readOnlyPort" not in cm.kubelet_args: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `readOnlyPort` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.py b/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.py index 3a6209a028..f708396481 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.py @@ -6,10 +6,9 @@ class kubelet_event_record_qps(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if "eventRecordQPS" not in cm.kubelet_args: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `eventRecordQPS` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.py b/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.py index 8c8ed1a54e..efb07f6a98 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.py @@ -6,10 +6,9 @@ class kubelet_manage_iptables(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if "makeIPTablesUtilChains" not in cm.kubelet_args: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `makeIPTablesUtilChains` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.py b/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.py index b16642b139..fa535157e5 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.py @@ -6,10 +6,9 @@ class kubelet_rotate_certificates(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if "rotateCertificates" not in cm.kubelet_args: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `streamingConnectionIdleTimeout` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.py b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.py index 08b847b306..2a7e207c8f 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.py @@ -7,10 +7,9 @@ class kubelet_service_file_ownership_root(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for node in core_client.nodes.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = node.namespace - report.resource_name = node.name - report.resource_id = node.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=node + ) # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one if node.inside: if ( diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.py b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.py index 78da065708..c16cab458b 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.py @@ -7,10 +7,9 @@ class kubelet_service_file_permissions(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for node in core_client.nodes.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = node.namespace - report.resource_name = node.name - report.resource_id = node.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=node + ) # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one if node.inside: if not get_file_permissions( diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.py b/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.py index 850f271bf9..cad73d2286 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.py @@ -6,10 +6,9 @@ class kubelet_streaming_connection_timeout(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if "streamingConnectionIdleTimeout" not in cm.kubelet_args: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `streamingConnectionIdleTimeout` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.py b/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.py index a8a53d8e17..cc2c3a3a56 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.py @@ -17,10 +17,9 @@ class kubelet_strong_ciphers_only(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if "tlsCipherSuites" not in cm.kubelet_args: report.status = "MANUAL" report.status_extended = f"Kubelet does not have the argument `tlsCipherSuites` in config file {cm.name}, verify it in the node's arguments." diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.py b/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.py index d9dbe467ed..bf421181c3 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.py +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.py @@ -6,10 +6,9 @@ class kubelet_tls_cert_and_key(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for cm in kubelet_client.kubelet_config_maps: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = cm.namespace - report.resource_name = cm.name - report.resource_id = cm.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cm + ) if ( "tlsCertFile" not in cm.kubelet_args or "tlsPrivateKeyFile" not in cm.kubelet_args diff --git a/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.py b/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.py index 55643277b8..49d42dfdd8 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.py @@ -9,14 +9,14 @@ class rbac_cluster_admin_usage(Check): for binding in rbac_client.cluster_role_bindings.values(): # Check if the binding refers to the cluster-admin role if binding.roleRef.name == "cluster-admin": - report = Check_Report_Kubernetes(self.metadata()) + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=binding.metadata + ) report.namespace = ( "cluster-wide" if not binding.metadata.namespace else binding.metadata.namespace ) - report.resource_name = binding.metadata.name - report.resource_id = binding.metadata.uid report.status = "MANUAL" report.status_extended = f"Cluster Role Binding {binding.metadata.name} uses cluster-admin role." findings.append(report) diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py index 622f4cce26..ab531292dc 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py @@ -14,10 +14,9 @@ class rbac_minimize_csr_approval_access(Check): for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: if subject.kind in ["User", "Group"]: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = subject.name - report.resource_id = subject.uid if hasattr(subject, "uid") else "" + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=subject + ) report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to update the CSR approval sub-resource." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py index 219b478458..f1a5b0285e 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py @@ -14,10 +14,9 @@ class rbac_minimize_node_proxy_subresource_access(Check): for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: if subject.kind in ["User", "Group"]: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = subject.name - report.resource_id = subject.uid if hasattr(subject, "uid") else "" + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=subject + ) report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to the node proxy sub-resource." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.py index 4b5c0c5661..e7e96cfee9 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.py @@ -13,10 +13,9 @@ class rbac_minimize_pod_creation_access(Check): findings = [] # Check ClusterRoleBindings for pod create access for cr in rbac_client.cluster_roles.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = cr.metadata.name - report.resource_id = cr.metadata.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cr.metadata + ) report.status = "PASS" report.status_extended = ( f"ClusterRole {cr.metadata.name} does not have pod create access." @@ -30,10 +29,9 @@ class rbac_minimize_pod_creation_access(Check): # Check RoleBindings for pod create access for role in rbac_client.roles.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = role.metadata.namespace - report.resource_name = role.metadata.name - report.resource_id = role.metadata.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=role.metadata + ) report.status = "PASS" report.status_extended = ( f"Role {role.metadata.name} does not have pod create access." diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py index e683aa9337..622983e8cc 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py @@ -15,10 +15,9 @@ class rbac_minimize_pv_creation_access(Check): for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: if subject.kind in ["User", "Group"]: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = subject.name - report.resource_id = subject.uid if hasattr(subject, "uid") else "" + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=subject + ) report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create PersistentVolumes." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.py index 16d7a90fe1..f847a3378d 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.py @@ -13,10 +13,9 @@ class rbac_minimize_secret_access(Check): findings = [] # Check ClusterRoleBindings for seceret access for cr in rbac_client.cluster_roles.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = cr.metadata.name - report.resource_id = cr.metadata.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cr.metadata + ) report.status = "PASS" report.status_extended = ( f"ClusterRole {cr.metadata.name} does not have secret access." @@ -30,10 +29,9 @@ class rbac_minimize_secret_access(Check): # Check RoleBindings for secret access for role in rbac_client.roles.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = role.metadata.namespace - report.resource_name = role.metadata.name - report.resource_id = role.metadata.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=role.metadata + ) report.status = "PASS" report.status_extended = ( f"Role {role.metadata.name} does not have secret access." diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py index 1b85d3caff..eb26d00f2d 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py @@ -14,10 +14,9 @@ class rbac_minimize_service_account_token_creation(Check): for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: if subject.kind in ["User", "Group"]: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = subject.name - report.resource_id = subject.uid if hasattr(subject, "uid") else "" + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=subject + ) report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py index 1ba11fe7c1..572846021c 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py @@ -17,10 +17,9 @@ class rbac_minimize_webhook_config_access(Check): for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: if subject.kind in ["User", "Group"]: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = subject.name - report.resource_id = subject.uid if hasattr(subject, "uid") else "" + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=subject + ) report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create, update, or delete webhook configurations." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.py index b6c6aa9160..05894e90c6 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.py @@ -7,10 +7,9 @@ class rbac_minimize_wildcard_use_roles(Check): findings = [] # Check ClusterRoles for wildcards for cr in rbac_client.cluster_roles.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = "cluster-wide" - report.resource_name = cr.metadata.name - report.resource_id = cr.metadata.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=cr.metadata + ) report.status = "PASS" report.status_extended = ( f"ClusterRole {cr.metadata.name} does not use wildcards." @@ -28,10 +27,9 @@ class rbac_minimize_wildcard_use_roles(Check): # Check Roles for wildcards for role in rbac_client.roles.values(): - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = role.metadata.namespace - report.resource_name = role.metadata.name - report.resource_id = role.metadata.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=role.metadata + ) report.status = "PASS" report.status_extended = ( f"Role {role.metadata.name} does not use wildcards." diff --git a/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.py b/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.py index 43309ba0f4..be8097832a 100644 --- a/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.py +++ b/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.py @@ -8,10 +8,9 @@ class scheduler_bind_address(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in scheduler_client.scheduler_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "PASS" report.status_extended = ( f"Scheduler is bound to the loopback address in pod {pod.name}." diff --git a/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.py b/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.py index d62c56e3be..53dbfd4a25 100644 --- a/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.py +++ b/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.py @@ -8,10 +8,9 @@ class scheduler_profiling(Check): def execute(self) -> Check_Report_Kubernetes: findings = [] for pod in scheduler_client.scheduler_pods: - report = Check_Report_Kubernetes(self.metadata()) - report.namespace = pod.namespace - report.resource_name = pod.name - report.resource_id = pod.uid + report = Check_Report_Kubernetes( + metadata=self.metadata(), resource_metadata=pod + ) report.status = "FAIL" report.status_extended = ( f"Scheduler has profiling enabled in pod {pod.name}."