ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(kubernetes): enhance checks metadata (#3469)

Browse Source
This commit is contained in:
Sergio Garcia
2024-02-29 17:16:28 +01:00
committed by GitHub
parent d8bb384689
commit fc03dd37f1
83 changed files with 379 additions and 693 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_always_pull_images_plugin",
"CheckTitle": "Ensure that the admission control plugin AlwaysPullImages is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include AlwaysPullImages in the --enable-admission-plugins argument. Example: --enable-admission-plugins=...,AlwaysPullImages,...",
"NativeIaC": "",
"CLI": "--enable-admission-plugins=...,AlwaysPullImages,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-alwayspullimages-is-set#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Image Security",
"Cluster Security"
"cluster-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.metadata.json
+4 -8
View File
@@ -2,10 +2,7 @@
"Provider": "kubernetes",
"CheckID": "apiserver_anonymous_requests",
"CheckTitle": "Ensure that the --anonymous-auth argument is set to false",
"CheckType": [
"Cluster Security",
"Authentication and Authorization"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "",
"ResourceIdTemplate": "",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/admin/authentication/#anonymous-requests",
"Remediation": {
"Code": {
"CLI": "Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml and set --anonymous-auth=false",
"NativeIaC": "",
"CLI": "--anonymous-auth=false",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-anonymous-auth-argument-is-set-to-false-1#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security Best Practices",
"Compliance"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_audit_log_maxage_set",
"CheckTitle": "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Auditing",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxage argument to 30 or an appropriate number of days. Example: --audit-log-maxage=30",
"NativeIaC": "",
"CLI": "--audit-log-maxage=30",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-maxage-argument-is-set-to-30-or-as-appropriate#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Logging",
"Compliance"
"logging"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_audit_log_maxbackup_set",
"CheckTitle": "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Auditing",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxbackup argument to 10 or an appropriate number. Example: --audit-log-maxbackup=10",
"NativeIaC": "",
"CLI": "--audit-log-maxbackup=10",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Logging",
"Compliance"
"logging"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_audit_log_maxsize_set",
"CheckTitle": "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Auditing",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxsize argument to 100 MB or an appropriate size. Example: --audit-log-maxsize=100",
"NativeIaC": "",
"CLI": "--audit-log-maxsize=100",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-maxsize-argument-is-set-to-100-or-as-appropriate#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Logging",
"Compliance"
"logging"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_audit_log_path_set",
"CheckTitle": "Ensure that the --audit-log-path argument is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Auditing",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set the --audit-log-path argument to a valid log path. Example: --audit-log-path=/var/log/apiserver/audit.log",
"NativeIaC": "",
"CLI": "--audit-log-path=/var/log/apiserver/audit.log",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-path-argument-is-set#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Logging",
"Compliance"
"logging"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_auth_mode_include_node",
"CheckTitle": "Ensure that the --authorization-mode argument includes Node",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Authorization",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/node/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include Node in the --authorization-mode argument. Example: --authorization-mode=Node,RBAC",
"NativeIaC": "",
"CLI": "--authorization-mode=Node,RBAC",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-authorization-mode-argument-includes-node",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_auth_mode_include_rbac",
"CheckTitle": "Ensure that the --authorization-mode argument includes RBAC",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Authorization",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include RBAC in the --authorization-mode argument. Example: --authorization-mode=Node,RBAC",
"NativeIaC": "",
"CLI": "--authorization-mode=Node,RBAC",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-authorization-mode-argument-includes-rbac",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_auth_mode_not_always_allow",
"CheckTitle": "Ensure that the --authorization-mode argument is not set to AlwaysAllow",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Authorization",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/authorization/#using-flags-for-your-authorization-module",
"Remediation": {
"Code": {
"CLI": "Set the --authorization-mode argument in the kube-apiserver configuration to a secure mode such as RBAC. Example: --authorization-mode=RBAC",
"NativeIaC": "",
"CLI": "--authorization-mode=RBAC",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-authorization-mode-argument-is-not-set-to-alwaysallow",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Cluster Security"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_client_ca_file_set",
"CheckTitle": "Ensure that the --client-ca-file argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "TLS Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include the --client-ca-file parameter with the appropriate CA file. Example: --client-ca-file=<path/to/client-ca-file>",
"NativeIaC": "",
"CLI": "--client-ca-file=<path/to/client-ca-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-client-ca-file-argument-is-set-as-appropriate-scored",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"TLS Configuration"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.metadata.json
+5 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_deny_service_external_ips",
"CheckTitle": "Ensure that the DenyServiceExternalIPs is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Controllers",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#denyserviceexternalips",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver manifest to include '--disable-admission-plugins=DenyServiceExternalIPs' in the API server's command arguments.",
"CLI": "--disable-admission-plugins=DenyServiceExternalIPs",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Network Policy",
"Security Best Practices"
"internet-exposed",
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_disable_profiling",
"CheckTitle": "Ensure that the --profiling argument is set to false",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Performance",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set the --profiling argument to false. Example: --profiling=false",
"NativeIaC": "",
"CLI": "--profiling=false",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-profiling-argument-is-set-to-false-2",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security Best Practices",
"Configuration Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_encryption_provider_config_set",
"CheckTitle": "Ensure that the --encryption-provider-config argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Data Encryption",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include the --encryption-provider-config parameter with the path to the EncryptionConfig file. Example: --encryption-provider-config=/path/to/EncryptionConfig/File",
"CLI": "--encryption-provider-config=/path/to/EncryptionConfig/File",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Data Security",
"Configuration Optimization"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_etcd_cafile_set",
"CheckTitle": "Ensure that the --etcd-cafile argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "etcd Connection",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include the --etcd-cafile parameter with the appropriate CA file. Example: --etcd-cafile=<path/to/ca-file>",
"NativeIaC": "",
"CLI": "--etcd-cafile=<path/to/ca-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-etcd-cafile-argument-is-set-as-appropriate-1",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"TLS Configuration"
"encryption",
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_etcd_tls_config",
"CheckTitle": "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "etcd Connection",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include TLS parameters for etcd connection. Example: --etcd-certfile=<path/to/client-certificate-file> --etcd-keyfile=<path/to/client-key-file>",
"NativeIaC": "",
"CLI": "--etcd-certfile=<path/to/client-certificate-file> --etcd-keyfile=<path/to/client-key-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-etcd-certfile-and-etcd-keyfile-arguments-are-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Data Security",
"Configuration Optimization"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_event_rate_limit",
"CheckTitle": "Ensure that the admission control plugin EventRateLimit is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include EventRateLimit in the --enable-admission-plugins argument and specify a configuration file. Example: --enable-admission-plugins=...,EventRateLimit,... --admission-control-config-file=/path/to/configuration/file",
"NativeIaC": "",
"CLI": "--enable-admission-plugins=...,EventRateLimit,... --admission-control-config-file=/path/to/configuration/file",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-eventratelimit-is-set",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Resource Management",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_kubelet_cert_auth",
"CheckTitle": "Ensure that the --kubelet-certificate-authority argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "TLS Verification",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/",
"Remediation": {
"Code": {
"CLI": "Set the --kubelet-certificate-authority argument in the kube-apiserver configuration to the path of the CA certificate file. Example: --kubelet-certificate-authority=/path/to/ca-file",
"NativeIaC": "",
"CLI": "--kubelet-certificate-authority=/path/to/ca-file",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-certificate-authority-argument-is-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Cluster Security",
"Communication Security"
"cluster-security",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_kubelet_tls_auth",
"CheckTitle": "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "TLS Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/",
"Remediation": {
"Code": {
"CLI": "Set the --kubelet-client-certificate and --kubelet-client-key arguments in the kube-apiserver configuration. Example: --kubelet-client-certificate=/path/to/client-certificate-file --kubelet-client-key=/path/to/client-key-file",
"NativeIaC": "",
"CLI": "--kubelet-client-certificate=/path/to/client-certificate-file --kubelet-client-key=/path/to/client-key-file",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-client-certificate-and-kubelet-client-key-arguments-are-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Cluster Security",
"Communication Security"
"cluster-security",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_namespace_lifecycle_plugin",
"CheckTitle": "Ensure that the admission control plugin NamespaceLifecycle is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to ensure that NamespaceLifecycle is included in the --enable-admission-plugins argument. Remove the plugin from --disable-admission-plugins if present.",
"NativeIaC": "",
"CLI": "--enable-admission-plugins=...,NamespaceLifecycle,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-namespacelifecycle-is-set",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Namespace Management",
"Cluster Security"
"cluster-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_no_always_admit_plugin",
"CheckTitle": "Ensure that the admission control plugin AlwaysAdmit is not set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to ensure that AlwaysAdmit is not included in the --enable-admission-plugins argument. Remove the plugin if it exists.",
"NativeIaC": "",
"CLI": "--disable-admission-plugins=...,AlwaysAdmit,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Deprecated Features"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_no_token_auth_file",
"CheckTitle": "Ensure that the --token-auth-file parameter is not set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/",
"Remediation": {
"Code": {
"CLI": "Remove the --token-auth-file parameter from the kube-apiserver configuration. Edit /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --token-auth-file=<filename> parameter.",
"NativeIaC": "",
"CLI": "",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-token-auth-file-parameter-is-not-set",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_node_restriction_plugin",
"CheckTitle": "Ensure that the admission control plugin NodeRestriction is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include NodeRestriction in the --enable-admission-plugins argument. Example: --enable-admission-plugins=...,NodeRestriction,...",
"NativeIaC": "",
"CLI": "--enable-admission-plugins=...,NodeRestriction,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-noderestriction-is-set",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Admission Control"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_request_timeout_set",
"CheckTitle": "Ensure that the --request-timeout argument is set as appropriate",
"CheckType": [
"Performance",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Request Handling",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set the --request-timeout argument to an appropriate value based on your environment. Example: --request-timeout=300s",
"NativeIaC": "",
"CLI": "--request-timeout=300s",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-request-timeout-argument-is-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Resource Management",
"Configuration Optimization"
"cluster-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_security_context_deny_plugin",
"CheckTitle": "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include SecurityContextDeny in the --enable-admission-plugins argument, unless PodSecurityPolicy is already in use. Example: --enable-admission-plugins=...,SecurityContextDeny,...",
"NativeIaC": "",
"CLI": "--enable-admission-plugins=...,SecurityContextDeny,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Pod Security",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_service_account_key_file_set",
"CheckTitle": "Ensure that the --service-account-key-file argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set --service-account-key-file to a valid public key file. Example: --service-account-key-file=<path/to/key-file>",
"NativeIaC": "",
"CLI": "--service-account-key-file=<path/to/key-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-service-account-key-file-argument-is-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Authentication",
"Key Management"
"trustboundaries",
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_service_account_lookup_true",
"CheckTitle": "Ensure that the --service-account-lookup argument is set to true",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to set --service-account-lookup to true. Example: --service-account-lookup=true",
"NativeIaC": "",
"CLI": "--service-account-lookup=true",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-service-account-lookup-argument-is-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_service_account_plugin",
"CheckTitle": "Ensure that the admission control plugin ServiceAccount is set",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "Admission Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to ensure that ServiceAccount is included in the --enable-admission-plugins argument. Remove the plugin from --disable-admission-plugins if present.",
"NativeIaC": "",
"CLI": "--enable-admission-plugins=...,ServiceAccount,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-serviceaccount-is-set",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Access Control",
"Service Accounts"
"trustboundaries",
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_strong_ciphers_only",
"CheckTitle": "Ensure that the API Server only makes use of Strong Cryptographic Ciphers",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "TLS Cipher Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include only strong cryptographic ciphers in the --tls-cipher-suites parameter. Example: --tls-cipher-suites=TLS_AES_128_GCM_SHA256,...",
"NativeIaC": "",
"CLI": "--tls-cipher-suites=TLS_AES_128_GCM_SHA256,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "apiserver_tls_config",
"CheckTitle": "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "apiserver",
"SubServiceName": "TLS Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesAPIServer",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-apiserver configuration to include TLS parameters. Example: --tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file>",
"NativeIaC": "",
"CLI": "--tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-tls-cert-file-and-tls-private-key-file-arguments-are-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Data Security",
"Configuration Optimization"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "controllermanager_bind_address",
"CheckTitle": "Ensure that the --bind-address argument is set to 127.0.0.1",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "Bind Address Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesControllerManager",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
"Remediation": {
"Code": {
"CLI": "Edit the controller-manager manifest to set --bind-address to 127.0.0.1.",
"NativeIaC": "",
"CLI": "--bind-address=127.0.0.1",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-bind-address-argument-is-set-to-127001",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Network Security",
"Configuration Management"
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.metadata.json
+5 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "controller_manager_disable_profiling",
"CheckTitle": "Ensure that the --profiling argument is set to false",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "Profiling Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesControllerManager",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
"Remediation": {
"Code": {
"CLI": "Edit the controller-manager manifest to set the --profiling argument to false.",
"NativeIaC": "",
"CLI": "--profiling=false",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-profiling-argument-is-set-to-false",
"Other": "",
"Terraform": ""
},
@@ -27,7 +24,7 @@
}
},
"Categories": [
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.metadata.json
+4 -8
View File
@@ -2,10 +2,7 @@
"Provider": "kubernetes",
"CheckID": "controllermanager_garbage_collection",
"CheckTitle": "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate",
"CheckType": [
"Resource Management",
"Performance Optimization"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "",
"ResourceIdTemplate": "",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-garbage-collection",
"Remediation": {
"Code": {
"CLI": "Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml and set --terminated-pod-gc-threshold to an appropriate value, e.g., --terminated-pod-gc-threshold=10",
"NativeIaC": "",
"CLI": "--terminated-pod-gc-threshold=10",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-terminated-pod-gc-threshold-argument-is-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Cluster Stability",
"Operational Best Practices"
"cluster-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "controllermanager_root_ca_file_set",
"CheckTitle": "Ensure that the --root-ca-file argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "Root CA File Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesControllerManager",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/",
"Remediation": {
"Code": {
"CLI": "Edit the controller-manager manifest to set the --root-ca-file argument to the appropriate certificate bundle file.",
"NativeIaC": "",
"CLI": "--root-ca-file=/path/to/ca-file",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-root-ca-file-argument-is-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "controllermanager_rotate_kubelet_server_cert",
"CheckTitle": "Ensure that the RotateKubeletServerCertificate argument is set to true",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "Kubelet Server Certificate Rotation",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesControllerManager",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/tasks/tls/certificate-rotation/",
"Remediation": {
"Code": {
"CLI": "Edit the controller-manager manifest to include RotateKubeletServerCertificate=true in the --feature-gates parameter.",
"NativeIaC": "",
"CLI": "--feature-gates='RotateKubeletServerCertificate=true'",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-for-controller-manager#kubernetes",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Data Security",
"Configuration Management"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "controllermanager_service_account_credentials",
"CheckTitle": "Ensure that the --use-service-account-credentials argument is set to true",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "Service Account Credentials",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesControllerManager",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
"Remediation": {
"Code": {
"CLI": "Edit the controller-manager manifest to set the --use-service-account-credentials argument to true.",
"NativeIaC": "",
"CLI": "--use-service-account-credentials=true",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-use-service-account-credentials-argument-is-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security Best Practices",
"Access Control"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "controllermanager_service_account_private_key_file",
"CheckTitle": "Ensure that the --service-account-private-key-file argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "controller-manager",
"SubServiceName": "Service Account Private Key File Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesControllerManager",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/",
"Remediation": {
"Code": {
"CLI": "Edit the controller-manager manifest to set the --service-account-private-key-file argument to the appropriate private key file.",
"NativeIaC": "",
"CLI": "--service-account-private-key-file=/path/to/sa-key-file",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-service-account-private-key-file-argument-is-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Data Security",
"Configuration Management"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_admission_hostport_containers",
"CheckTitle": "Minimize the admission of containers which use HostPorts",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "HostPorts",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Network Security",
"Best Practices"
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_admission_windows_hostprocess_containers",
"CheckTitle": "Minimize the admission of Windows HostProcess Containers",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Windows HostProcess Containers",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_allowPrivilegeEscalation_containers",
"CheckTitle": "Minimize the admission of containers with allowPrivilegeEscalation",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Privilege Escalation Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_containers_added_capabilities",
"CheckTitle": "Minimize the admission of containers with added capabilities",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Capability Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_containers_capabilities_assigned",
"CheckTitle": "Minimize the admission of containers with capabilities assigned",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Capability Assignment",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_hostIPC_containers",
"CheckTitle": "Minimize the admission of containers wishing to share the host IPC namespace",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Host IPC Namespace",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_hostNetwork_containers",
"CheckTitle": "Minimize the admission of containers wishing to share the host network namespace",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Host Network Namespace",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_hostPID_containers",
"CheckTitle": "Minimize the admission of containers wishing to share the host process ID namespace",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Host PID Namespace",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_net_raw_capability_admission",
"CheckTitle": "Minimize the admission of containers with the NET_RAW capability",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Capability Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_privileged_containers",
"CheckTitle": "Minimize the admission of privileged containers",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Privileged Containers",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_minimize_root_containers_admission",
"CheckTitle": "Minimize the admission of root containers",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Root User Control",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_no_secrets_envs",
"CheckTitle": "Prefer using secrets as files over secrets as environment variables",
"CheckType": [
"Best Practice",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Secrets Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesSecrets",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security",
"Configuration Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "core_seccomp_profile_docker_default",
"CheckTitle": "Ensure that the seccomp profile is set to docker/default in your pod definitions",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "core",
"SubServiceName": "Seccomp Profile",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesPod",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Container Security",
"Best Practices"
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "etcd_client_cert_auth",
"CheckTitle": "Ensure that the --client-cert-auth argument is set to true for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "Client Certificate Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "EtcdService",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Edit the etcd pod specification file to set --client-cert-auth to true. Example: --client-cert-auth=\"true\".",
"NativeIaC": "",
"CLI": "--client-cert-auth=true",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-client-cert-auth-argument-is-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Access Control"
"encryption",
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "etcd_no_auto_tls",
"CheckTitle": "Ensure that the --auto-tls argument is not set to true for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "TLS Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "EtcdService",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Edit the etcd pod specification file to set --auto-tls to false or remove the parameter. Example: --auto-tls=false.",
"NativeIaC": "",
"CLI": "--auto-tls=false",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-auto-tls-argument-is-not-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "etcd_no_peer_auto_tls",
"CheckTitle": "Ensure that the --peer-auto-tls argument is not set to true for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "Peer TLS Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "EtcdService",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Configure etcd to avoid using self-signed certificates for peer connections by editing the etcd pod specification file with the --peer-auto-tls parameter set to false. Example: --peer-auto-tls=false.",
"NativeIaC": "",
"CLI": "--peer-auto-tls=false",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-peer-auto-tls-argument-is-not-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "etcd_peer_client_cert_auth",
"CheckTitle": "Ensure that the --peer-client-cert-auth argument is set to true for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "Peer Client Certificate Authentication",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "EtcdService",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Configure peer client certificate authentication by editing the etcd pod specification file with the --peer-client-cert-auth parameter set to true. Example: --peer-client-cert-auth=true.",
"NativeIaC": "",
"CLI": "--peer-client-cert-auth=true",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-peer-client-cert-auth-argument-is-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "etcd_peer_tls_config",
"CheckTitle": "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "Peer TLS Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "EtcdService",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Configure peer TLS encryption by editing the etcd pod specification file with appropriate certificate and key files. Example: --peer-client-file=</path/to/peer-cert-file> --peer-key-file=</path/to/peer-key-file>.",
"NativeIaC": "",
"CLI": "--peer-client-file=</path/to/peer-cert-file> --peer-key-file=</path/to/peer-key-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-peer-cert-file-and-peer-key-file-arguments-are-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.metadata.json
+4 -8
View File
@@ -2,10 +2,7 @@
"Provider": "kubernetes",
"CheckID": "etcd_tls_encryption",
"CheckTitle": "Ensure that the --cert-file and --key-file arguments are set as appropriate for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "",
"ResourceIdTemplate": "",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the --cert-file and --key-file arguments appropriately.",
"NativeIaC": "",
"CLI": "--cert-file=/path/to/cert-file --key-file=/path/to/key-file",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-cert-file-and-key-file-arguments-are-set-as-appropriate",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Cluster Security",
"Data Protection"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "etcd_unique_ca",
"CheckTitle": "Ensure that a unique Certificate Authority is used for etcd",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "etcd",
"SubServiceName": "Certificate Authority Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "EtcdService",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/",
"Remediation": {
"Code": {
"CLI": "Configure etcd to use a unique CA by setting the --trusted-ca-file parameter in the etcd pod specification to point to the dedicated etcd CA file. Example: --trusted-ca-file=</path/to/etcd-ca-file>.",
"CLI": "--trusted-ca-file=</path/to/etcd-ca-file>",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Data Security",
"Configuration Management"
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_authorization_mode",
"CheckTitle": "Ensure that the kubelet --authorization-mode argument is not set to AlwaysAllow",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Authorization Mode",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/",
"Remediation": {
"Code": {
"CLI": "Edit the kubelet service file on each worker node to set --authorization-mode to Webhook.",
"CLI": "--authorization-mode=Webhook",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security",
"Node Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_client_ca_file_set",
"CheckTitle": "Ensure that the kubelet --client-ca-file argument is set as appropriate",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Client CA File",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/",
"Remediation": {
"Code": {
"CLI": "Set the --client-ca-file argument in the kubelet service file on each worker node to the path of the client CA file.",
"CLI": "--client-ca-file=/path/to/ca-file",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security",
"Node Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_conf_file_ownership",
"CheckTitle": "Ensure kubelet.conf file ownership is set to root:root",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Config File Ownership",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesWorkerNode",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Compliance"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_conf_file_permissions",
"CheckTitle": "Ensure kubelet.conf file permissions are set to 600 or more restrictive",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Config File Permissions",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesWorkerNode",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Compliance"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_config_yaml_ownership",
"CheckTitle": "Validate kubelet config.yaml File Ownership",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Config File Ownership",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesWorkerNode",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Compliance"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_config_yaml_permissions",
"CheckTitle": "Validate kubelet config.yaml File Permissions",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Config File Permissions",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesWorkerNode",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Compliance"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_disable_anonymous_auth",
"CheckTitle": "Ensure that the --anonymous-auth argument is set to false",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Authentication Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/#kubelet-authorization",
"Remediation": {
"Code": {
"CLI": "Edit the kubelet configuration file or service file to set the --anonymous-auth argument to false. For service file: systemctl daemon-reload; systemctl restart kubelet.service",
"CLI": "--anonymous-auth=false",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security",
"Configuration Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_disable_read_only_port",
"CheckTitle": "Verify that the kubelet --read-only-port argument is set to 0",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Read-Only Port Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/",
"Remediation": {
"Code": {
"CLI": "Set the --read-only-port argument in the kubelet service file on each worker node to 0.",
"NativeIaC": "",
"CLI": "--read-only-port=0",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-read-only-port-argument-is-set-to-0",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Security",
"Node Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_event_record_qps",
"CheckTitle": "Ensure that the kubelet eventRecordQPS argument is set to an appropriate level",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Event Recording",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/",
"Remediation": {
"Code": {
"CLI": "Set the eventRecordQPS argument in the kubelet configuration file to an appropriate level that balances event capture with system performance.",
"NativeIaC": "",
"CLI": "--event-qps=<appropriate_level>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Event Logging",
"System Performance"
"logging"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_manage_iptables",
"CheckTitle": "Ensure that the kubelet --make-iptables-util-chains argument is set to true",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Iptables Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/",
"Remediation": {
"Code": {
"CLI": "Set the --make-iptables-util-chains argument in the kubelet service file on each worker node to true.",
"NativeIaC": "",
"CLI": "--make-iptables-util-chains=true",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-make-iptables-util-chains-argument-is-set-to-true",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Network Security",
"Node Management"
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_rotate_certificates",
"CheckTitle": "Ensure that the kubelet client certificate rotation is enabled",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Certificate Rotation",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/",
"Remediation": {
"Code": {
"CLI": "Ensure that the kubelet is configured with --rotate-certificates set to true or omitted (to use default).",
"NativeIaC": "",
"CLI": "--rotate-certificates=true",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-rotate-certificates-argument-is-not-set-to-false",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_service_file_ownership_root",
"CheckTitle": "Ensure that the kubelet service file ownership is set to root:root",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Service File Ownership",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesWorkerNode",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Compliance"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.metadata.json
+3 -7
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_service_file_permissions",
"CheckTitle": "Ensure that the kubelet service file permissions are set to 600 or more restrictive",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Kubelet Service File Permission",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesNode",
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Configuration Management"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_streaming_connection_timeout",
"CheckTitle": "Ensure that the kubelet --streaming-connection-idle-timeout argument is not set to 0",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "Streaming Connection Timeout",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/",
"Remediation": {
"Code": {
"CLI": "Set the --streaming-connection-idle-timeout argument in the kubelet service file on each worker node to a non-zero value.",
"NativeIaC": "",
"CLI": "--streaming-connection-idle-timeout=<non-zero value>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-streaming-connection-idle-timeout-argument-is-not-set-to-0",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Node Security",
"Denial-of-Service Prevention"
"node-security"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_strong_ciphers_only",
"CheckTitle": "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "TLS Cipher Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/",
"Remediation": {
"Code": {
"CLI": "Configure the kubelet to use only strong cryptographic ciphers by setting the --tls-cipher-suites parameter. Example: --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,...",
"NativeIaC": "",
"CLI": "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,...",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "kubelet_tls_cert_and_key",
"CheckTitle": "Ensure that the kubelet TLS certificate and private key are set appropriately",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "kubelet",
"SubServiceName": "TLS Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "KubernetesKubelet",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/",
"Remediation": {
"Code": {
"CLI": "Set the --tls-cert-file and --tls-private-key-file arguments in the kubelet configuration. Example: --tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file>.",
"NativeIaC": "",
"CLI": "--tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file>",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-tls-cert-file-and-tls-private-key-file-arguments-are-set-as-appropriate-for-kubelet",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Data Security",
"Network Security"
"encryption",
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_cluster_admin_usage",
"CheckTitle": "Ensure that the cluster-admin role is only used where required",
"CheckType": [
"Security",
"Compliance"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Authorization",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "ClusterRoleBinding",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles",
"Remediation": {
"Code": {
"CLI": "Review and, if necessary, modify the ClusterRoleBindings to limit the use of 'cluster-admin'. Use 'kubectl delete clusterrolebinding [name]' to remove unnecessary bindings.",
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Least Privilege Principle"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_csr_approval_access",
"CheckTitle": "Minimize access to the approval sub-resource of certificatesigningrequests objects",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "CSR Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "CertificateSigningRequestApproval",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#csrs-and-certificate-issuing",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC configurations to restrict access to the approval sub-resource of CSR objects. Ensure that only trusted users or service accounts have the required permissions.",
"NativeIaC": "",
"CLI": "",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-clusterroles-that-grant-permissions-to-approve-certificatesigningrequests-are-minimized",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Privilege Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_node_proxy_subresource_access",
"CheckTitle": "Minimize access to the proxy sub-resource of nodes",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Node Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "NodeProxySubResource",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#access-to-proxy-subresource-of-nodes",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC configurations to restrict access to the proxy sub-resource of node objects. Ensure that only trusted users have the required permissions.",
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Privilege Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_pod_creation_access",
"CheckTitle": "Minimize access to create pods",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Pod Creation Access Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "Pod",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC settings to restrict pod creation access to necessary users only. Use `kubectl get clusterrolebindings -o yaml` and `kubectl get rolebindings --all-namespaces -o yaml` to identify users with pod creation privileges.",
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Policy Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_pv_creation_access",
"CheckTitle": "Minimize access to create persistent volumes",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Persistent Volume Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "PersistentVolume",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#persistent-volume-creation",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC configurations to restrict creation access to PersistentVolume objects. Ensure that only trusted users have the required permissions.",
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Privilege Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.metadata.json
+6 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_secret_access",
"CheckTitle": "Minimize access to secrets",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Secrets Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "Secrets",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/configuration/secret/",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC configurations to restrict get, list, and watch permissions for secrets. Use Role and RoleBinding for namespace-specific access, and ClusterRole and ClusterRoleBinding for cluster-wide access.",
"NativeIaC": "",
"CLI": "",
"NativeIaC": "https://docs.bridgecrew.io/docs/no-serviceaccountnode-should-be-able-to-read-all-secrets",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,8 @@
}
},
"Categories": [
"Access Control",
"Data Security"
"trustboundaries",
"encryption"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.metadata.json
+4 -8
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_service_account_token_creation",
"CheckTitle": "Minimize access to the service account token creation",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Service Account Token Creation",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "ServiceAccountToken",
@@ -16,7 +13,7 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#token-request",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC configurations to restrict access to the token sub-resource of serviceaccount objects. Ensure only trusted users or service accounts have necessary permissions.",
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Configuration Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_webhook_config_access",
"CheckTitle": "Minimize access to webhook configuration objects",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Webhook Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "WebhookConfiguration",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#control-admission-webhooks",
"Remediation": {
"Code": {
"CLI": "Review and update RBAC configurations to restrict access to validatingwebhookconfigurations and mutatingwebhookconfigurations. Ensure only trusted users or service accounts have necessary permissions.",
"NativeIaC": "",
"CLI": "",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-clusterroles-that-grant-control-over-validating-or-mutating-admission-webhook-configurations-are-minimized",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Configuration Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "rbac_minimize_wildcard_use_roles",
"CheckTitle": "Minimize wildcard use in Roles and ClusterRoles",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "RBAC",
"SubServiceName": "Roles Management",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "Role/ClusterRole",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
"Remediation": {
"Code": {
"CLI": "Review and update Roles and ClusterRoles to replace wildcards with specific resource names and actions. Use `kubectl get roles --all-namespaces -o yaml` and `kubectl get clusterroles -o yaml` to list current configurations.",
"NativeIaC": "",
"CLI": "",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-minimized-wildcard-use-in-roles-and-clusterroles",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Access Control",
"Policy Management"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.metadata.json
+5 -9
View File
@@ -2,12 +2,9 @@
"Provider": "kubernetes",
"CheckID": "scheduler_bind_address",
"CheckTitle": "Ensure that the --bind-address argument is set to 127.0.0.1 for the Scheduler",
"CheckType": [
"Security",
"Configuration"
],
"CheckType": [],
"ServiceName": "scheduler",
"SubServiceName": "Bind Address Configuration",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "KubernetesScheduler",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/",
"Remediation": {
"Code": {
"CLI": "Edit the kube-scheduler configuration to set --bind-address to 127.0.0.1.",
"NativeIaC": "",
"CLI": "--bind-address=127.0.0.1",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-bind-address-argument-is-set-to-127001-1",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Network Security",
"Configuration Management"
"internet-exposed"
],
"DependsOn": [],
"RelatedTo": [],
prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.metadata.json
+4 -8
View File
@@ -2,10 +2,7 @@
"Provider": "kubernetes",
"CheckID": "scheduler_profiling",
"CheckTitle": "Ensure that the --profiling argument is set to false",
"CheckType": [
"Cluster Performance",
"Cluster Security"
],
"CheckType": [],
"ServiceName": "scheduler",
"SubServiceName": "",
"ResourceIdTemplate": "",
@@ -16,8 +13,8 @@
"RelatedUrl": "https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md",
"Remediation": {
"Code": {
"CLI": "Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml and set --profiling=false",
"NativeIaC": "",
"CLI": "--profiling=false",
"NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-profiling-argument-is-set-to-false-2",
"Other": "",
"Terraform": ""
},
@@ -27,8 +24,7 @@
}
},
"Categories": [
"Performance Optimization",
"Security Best Practices"
"trustboundaries"
],
"DependsOn": [],
"RelatedTo": [],