diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.metadata.json index abc7d3524f..37278ab528 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_always_pull_images_plugin/apiserver_always_pull_images_plugin.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_always_pull_images_plugin", "CheckTitle": "Ensure that the admission control plugin AlwaysPullImages is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include AlwaysPullImages in the --enable-admission-plugins argument. Example: --enable-admission-plugins=...,AlwaysPullImages,...", - "NativeIaC": "", + "CLI": "--enable-admission-plugins=...,AlwaysPullImages,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-alwayspullimages-is-set#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Image Security", - "Cluster Security" + "cluster-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.metadata.json index 626ceea41c..48cae9c8c2 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_anonymous_requests/apiserver_anonymous_requests.metadata.json @@ -2,10 +2,7 @@ "Provider": "kubernetes", "CheckID": "apiserver_anonymous_requests", "CheckTitle": "Ensure that the --anonymous-auth argument is set to false", - "CheckType": [ - "Cluster Security", - "Authentication and Authorization" - ], + "CheckType": [], "ServiceName": "apiserver", "SubServiceName": "", "ResourceIdTemplate": "", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/admin/authentication/#anonymous-requests", "Remediation": { "Code": { - "CLI": "Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml and set --anonymous-auth=false", - "NativeIaC": "", + "CLI": "--anonymous-auth=false", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-anonymous-auth-argument-is-set-to-false-1#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security Best Practices", - "Compliance" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.metadata.json index 192c01d48d..308b650228 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxage_set/apiserver_audit_log_maxage_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_audit_log_maxage_set", "CheckTitle": "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Auditing", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxage argument to 30 or an appropriate number of days. Example: --audit-log-maxage=30", - "NativeIaC": "", + "CLI": "--audit-log-maxage=30", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-maxage-argument-is-set-to-30-or-as-appropriate#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Logging", - "Compliance" + "logging" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.metadata.json index 4c305eb2da..94380d2117 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxbackup_set/apiserver_audit_log_maxbackup_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_audit_log_maxbackup_set", "CheckTitle": "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Auditing", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxbackup argument to 10 or an appropriate number. Example: --audit-log-maxbackup=10", - "NativeIaC": "", + "CLI": "--audit-log-maxbackup=10", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Logging", - "Compliance" + "logging" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.metadata.json index 1a4cd32839..ab57c35630 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_maxsize_set/apiserver_audit_log_maxsize_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_audit_log_maxsize_set", "CheckTitle": "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Auditing", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxsize argument to 100 MB or an appropriate size. Example: --audit-log-maxsize=100", - "NativeIaC": "", + "CLI": "--audit-log-maxsize=100", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-maxsize-argument-is-set-to-100-or-as-appropriate#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Logging", - "Compliance" + "logging" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.metadata.json index 50ac6da800..27ad2ffd0f 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_audit_log_path_set/apiserver_audit_log_path_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_audit_log_path_set", "CheckTitle": "Ensure that the --audit-log-path argument is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Auditing", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set the --audit-log-path argument to a valid log path. Example: --audit-log-path=/var/log/apiserver/audit.log", - "NativeIaC": "", + "CLI": "--audit-log-path=/var/log/apiserver/audit.log", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-audit-log-path-argument-is-set#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Logging", - "Compliance" + "logging" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.metadata.json index 78253a83f1..99cc089fed 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_node/apiserver_auth_mode_include_node.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_auth_mode_include_node", "CheckTitle": "Ensure that the --authorization-mode argument includes Node", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Authorization", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/node/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include Node in the --authorization-mode argument. Example: --authorization-mode=Node,RBAC", - "NativeIaC": "", + "CLI": "--authorization-mode=Node,RBAC", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-authorization-mode-argument-includes-node", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.metadata.json index b6c5fe52f4..4e9d2a33d4 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_include_rbac/apiserver_auth_mode_include_rbac.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_auth_mode_include_rbac", "CheckTitle": "Ensure that the --authorization-mode argument includes RBAC", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Authorization", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include RBAC in the --authorization-mode argument. Example: --authorization-mode=Node,RBAC", - "NativeIaC": "", + "CLI": "--authorization-mode=Node,RBAC", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-authorization-mode-argument-includes-rbac", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.metadata.json index d79faf7573..fc26af6de3 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_auth_mode_not_always_allow/apiserver_auth_mode_not_always_allow.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_auth_mode_not_always_allow", "CheckTitle": "Ensure that the --authorization-mode argument is not set to AlwaysAllow", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Authorization", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/authorization/#using-flags-for-your-authorization-module", "Remediation": { "Code": { - "CLI": "Set the --authorization-mode argument in the kube-apiserver configuration to a secure mode such as RBAC. Example: --authorization-mode=RBAC", - "NativeIaC": "", + "CLI": "--authorization-mode=RBAC", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-authorization-mode-argument-is-not-set-to-alwaysallow", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Cluster Security" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.metadata.json index 7ce9e4a528..066827646b 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_client_ca_file_set/apiserver_client_ca_file_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_client_ca_file_set", "CheckTitle": "Ensure that the --client-ca-file argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "TLS Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include the --client-ca-file parameter with the appropriate CA file. Example: --client-ca-file=", - "NativeIaC": "", + "CLI": "--client-ca-file=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-client-ca-file-argument-is-set-as-appropriate-scored", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "TLS Configuration" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.metadata.json index eee1fb19a1..cfc25d59fc 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_deny_service_external_ips/apiserver_deny_service_external_ips.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_deny_service_external_ips", "CheckTitle": "Ensure that the DenyServiceExternalIPs is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Controllers", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#denyserviceexternalips", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver manifest to include '--disable-admission-plugins=DenyServiceExternalIPs' in the API server's command arguments.", + "CLI": "--disable-admission-plugins=DenyServiceExternalIPs", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,8 @@ } }, "Categories": [ - "Network Policy", - "Security Best Practices" + "internet-exposed", + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.metadata.json index b498fa3d0f..3086749866 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_disable_profiling/apiserver_disable_profiling.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_disable_profiling", "CheckTitle": "Ensure that the --profiling argument is set to false", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Performance", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set the --profiling argument to false. Example: --profiling=false", - "NativeIaC": "", + "CLI": "--profiling=false", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-profiling-argument-is-set-to-false-2", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security Best Practices", - "Configuration Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.metadata.json index 2c08c0534a..e260dacba8 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_encryption_provider_config_set/apiserver_encryption_provider_config_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_encryption_provider_config_set", "CheckTitle": "Ensure that the --encryption-provider-config argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Data Encryption", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include the --encryption-provider-config parameter with the path to the EncryptionConfig file. Example: --encryption-provider-config=/path/to/EncryptionConfig/File", + "CLI": "--encryption-provider-config=/path/to/EncryptionConfig/File", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Data Security", - "Configuration Optimization" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.metadata.json index 63a5678aeb..6a1dae69ee 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_cafile_set/apiserver_etcd_cafile_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_etcd_cafile_set", "CheckTitle": "Ensure that the --etcd-cafile argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "etcd Connection", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include the --etcd-cafile parameter with the appropriate CA file. Example: --etcd-cafile=", - "NativeIaC": "", + "CLI": "--etcd-cafile=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-etcd-cafile-argument-is-set-as-appropriate-1", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "TLS Configuration" + "encryption", + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.metadata.json index 9806e382ab..7d7a8a7244 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_etcd_tls_config/apiserver_etcd_tls_config.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_etcd_tls_config", "CheckTitle": "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "etcd Connection", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include TLS parameters for etcd connection. Example: --etcd-certfile= --etcd-keyfile=", - "NativeIaC": "", + "CLI": "--etcd-certfile= --etcd-keyfile=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-etcd-certfile-and-etcd-keyfile-arguments-are-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Data Security", - "Configuration Optimization" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.metadata.json index 4ac35b054d..051af8834e 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_event_rate_limit/apiserver_event_rate_limit.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_event_rate_limit", "CheckTitle": "Ensure that the admission control plugin EventRateLimit is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include EventRateLimit in the --enable-admission-plugins argument and specify a configuration file. Example: --enable-admission-plugins=...,EventRateLimit,... --admission-control-config-file=/path/to/configuration/file", - "NativeIaC": "", + "CLI": "--enable-admission-plugins=...,EventRateLimit,... --admission-control-config-file=/path/to/configuration/file", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-eventratelimit-is-set", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Resource Management", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.metadata.json index 733c5f768d..ac44e35e9a 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_cert_auth/apiserver_kubelet_cert_auth.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_kubelet_cert_auth", "CheckTitle": "Ensure that the --kubelet-certificate-authority argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "TLS Verification", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/", "Remediation": { "Code": { - "CLI": "Set the --kubelet-certificate-authority argument in the kube-apiserver configuration to the path of the CA certificate file. Example: --kubelet-certificate-authority=/path/to/ca-file", - "NativeIaC": "", + "CLI": "--kubelet-certificate-authority=/path/to/ca-file", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-certificate-authority-argument-is-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Cluster Security", - "Communication Security" + "cluster-security", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.metadata.json index c254fdb12f..05ac387273 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_kubelet_tls_auth/apiserver_kubelet_tls_auth.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_kubelet_tls_auth", "CheckTitle": "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "TLS Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/", "Remediation": { "Code": { - "CLI": "Set the --kubelet-client-certificate and --kubelet-client-key arguments in the kube-apiserver configuration. Example: --kubelet-client-certificate=/path/to/client-certificate-file --kubelet-client-key=/path/to/client-key-file", - "NativeIaC": "", + "CLI": "--kubelet-client-certificate=/path/to/client-certificate-file --kubelet-client-key=/path/to/client-key-file", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-client-certificate-and-kubelet-client-key-arguments-are-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Cluster Security", - "Communication Security" + "cluster-security", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.metadata.json index 9fc191f190..8e10d7c2f8 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_namespace_lifecycle_plugin/apiserver_namespace_lifecycle_plugin.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_namespace_lifecycle_plugin", "CheckTitle": "Ensure that the admission control plugin NamespaceLifecycle is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to ensure that NamespaceLifecycle is included in the --enable-admission-plugins argument. Remove the plugin from --disable-admission-plugins if present.", - "NativeIaC": "", + "CLI": "--enable-admission-plugins=...,NamespaceLifecycle,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-namespacelifecycle-is-set", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Namespace Management", - "Cluster Security" + "cluster-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.metadata.json index 510bf91603..70f9e37960 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_no_always_admit_plugin/apiserver_no_always_admit_plugin.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_no_always_admit_plugin", "CheckTitle": "Ensure that the admission control plugin AlwaysAdmit is not set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to ensure that AlwaysAdmit is not included in the --enable-admission-plugins argument. Remove the plugin if it exists.", - "NativeIaC": "", + "CLI": "--disable-admission-plugins=...,AlwaysAdmit,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Deprecated Features" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.metadata.json index c1bd2204b6..2d07fa14cc 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_no_token_auth_file/apiserver_no_token_auth_file.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_no_token_auth_file", "CheckTitle": "Ensure that the --token-auth-file parameter is not set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/", "Remediation": { "Code": { - "CLI": "Remove the --token-auth-file parameter from the kube-apiserver configuration. Edit /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --token-auth-file= parameter.", - "NativeIaC": "", + "CLI": "", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-token-auth-file-parameter-is-not-set", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.metadata.json index 1bad86ab7d..daac99a15d 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_node_restriction_plugin/apiserver_node_restriction_plugin.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_node_restriction_plugin", "CheckTitle": "Ensure that the admission control plugin NodeRestriction is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include NodeRestriction in the --enable-admission-plugins argument. Example: --enable-admission-plugins=...,NodeRestriction,...", - "NativeIaC": "", + "CLI": "--enable-admission-plugins=...,NodeRestriction,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-noderestriction-is-set", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Admission Control" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.metadata.json index 7468c36e2a..45f8ea731a 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_request_timeout_set/apiserver_request_timeout_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_request_timeout_set", "CheckTitle": "Ensure that the --request-timeout argument is set as appropriate", - "CheckType": [ - "Performance", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Request Handling", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set the --request-timeout argument to an appropriate value based on your environment. Example: --request-timeout=300s", - "NativeIaC": "", + "CLI": "--request-timeout=300s", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-request-timeout-argument-is-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Resource Management", - "Configuration Optimization" + "cluster-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.metadata.json index 78ff5a4b01..2b0e378e2d 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_security_context_deny_plugin/apiserver_security_context_deny_plugin.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_security_context_deny_plugin", "CheckTitle": "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include SecurityContextDeny in the --enable-admission-plugins argument, unless PodSecurityPolicy is already in use. Example: --enable-admission-plugins=...,SecurityContextDeny,...", - "NativeIaC": "", + "CLI": "--enable-admission-plugins=...,SecurityContextDeny,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Pod Security", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.metadata.json index 4722479bca..896f2d1847 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_key_file_set/apiserver_service_account_key_file_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_service_account_key_file_set", "CheckTitle": "Ensure that the --service-account-key-file argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set --service-account-key-file to a valid public key file. Example: --service-account-key-file=", - "NativeIaC": "", + "CLI": "--service-account-key-file=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-service-account-key-file-argument-is-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Authentication", - "Key Management" + "trustboundaries", + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.metadata.json index 147555ffea..5665797c37 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_lookup_true/apiserver_service_account_lookup_true.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_service_account_lookup_true", "CheckTitle": "Ensure that the --service-account-lookup argument is set to true", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to set --service-account-lookup to true. Example: --service-account-lookup=true", - "NativeIaC": "", + "CLI": "--service-account-lookup=true", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-service-account-lookup-argument-is-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.metadata.json index 5a1f5e4572..6a948f01fa 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_service_account_plugin/apiserver_service_account_plugin.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_service_account_plugin", "CheckTitle": "Ensure that the admission control plugin ServiceAccount is set", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "Admission Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to ensure that ServiceAccount is included in the --enable-admission-plugins argument. Remove the plugin from --disable-admission-plugins if present.", - "NativeIaC": "", + "CLI": "--enable-admission-plugins=...,ServiceAccount,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-admission-control-plugin-serviceaccount-is-set", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Access Control", - "Service Accounts" + "trustboundaries", + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.metadata.json index 15b3769587..5551a485a9 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_strong_ciphers_only", "CheckTitle": "Ensure that the API Server only makes use of Strong Cryptographic Ciphers", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "TLS Cipher Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include only strong cryptographic ciphers in the --tls-cipher-suites parameter. Example: --tls-cipher-suites=TLS_AES_128_GCM_SHA256,...", - "NativeIaC": "", + "CLI": "--tls-cipher-suites=TLS_AES_128_GCM_SHA256,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.metadata.json b/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.metadata.json index af79cf8410..e59028d095 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.metadata.json +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_tls_config/apiserver_tls_config.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "apiserver_tls_config", "CheckTitle": "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "apiserver", - "SubServiceName": "TLS Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesAPIServer", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/", "Remediation": { "Code": { - "CLI": "Edit the kube-apiserver configuration to include TLS parameters. Example: --tls-cert-file= --tls-private-key-file=", - "NativeIaC": "", + "CLI": "--tls-cert-file= --tls-private-key-file=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-tls-cert-file-and-tls-private-key-file-arguments-are-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Data Security", - "Configuration Optimization" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.metadata.json index f981886c5e..516ef6934b 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "controllermanager_bind_address", "CheckTitle": "Ensure that the --bind-address argument is set to 127.0.0.1", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "controller-manager", - "SubServiceName": "Bind Address Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesControllerManager", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/", "Remediation": { "Code": { - "CLI": "Edit the controller-manager manifest to set --bind-address to 127.0.0.1.", - "NativeIaC": "", + "CLI": "--bind-address=127.0.0.1", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-bind-address-argument-is-set-to-127001", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Network Security", - "Configuration Management" + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.metadata.json index 434a3de7cd..56c0bc6a98 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "controller_manager_disable_profiling", "CheckTitle": "Ensure that the --profiling argument is set to false", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "controller-manager", - "SubServiceName": "Profiling Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesControllerManager", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/", "Remediation": { "Code": { - "CLI": "Edit the controller-manager manifest to set the --profiling argument to false.", - "NativeIaC": "", + "CLI": "--profiling=false", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-profiling-argument-is-set-to-false", "Other": "", "Terraform": "" }, @@ -27,7 +24,7 @@ } }, "Categories": [ - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.metadata.json index d10885cb2f..95d2d3982f 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_garbage_collection/controllermanager_garbage_collection.metadata.json @@ -2,10 +2,7 @@ "Provider": "kubernetes", "CheckID": "controllermanager_garbage_collection", "CheckTitle": "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate", - "CheckType": [ - "Resource Management", - "Performance Optimization" - ], + "CheckType": [], "ServiceName": "controller-manager", "SubServiceName": "", "ResourceIdTemplate": "", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-garbage-collection", "Remediation": { "Code": { - "CLI": "Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml and set --terminated-pod-gc-threshold to an appropriate value, e.g., --terminated-pod-gc-threshold=10", - "NativeIaC": "", + "CLI": "--terminated-pod-gc-threshold=10", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-terminated-pod-gc-threshold-argument-is-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Cluster Stability", - "Operational Best Practices" + "cluster-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.metadata.json index baf2013240..c730378c3d 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "controllermanager_root_ca_file_set", "CheckTitle": "Ensure that the --root-ca-file argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "controller-manager", - "SubServiceName": "Root CA File Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesControllerManager", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/", "Remediation": { "Code": { - "CLI": "Edit the controller-manager manifest to set the --root-ca-file argument to the appropriate certificate bundle file.", - "NativeIaC": "", + "CLI": "--root-ca-file=/path/to/ca-file", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-root-ca-file-argument-is-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.metadata.json index e8fdb61c64..804cf5509e 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "controllermanager_rotate_kubelet_server_cert", "CheckTitle": "Ensure that the RotateKubeletServerCertificate argument is set to true", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "controller-manager", - "SubServiceName": "Kubelet Server Certificate Rotation", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesControllerManager", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/tasks/tls/certificate-rotation/", "Remediation": { "Code": { - "CLI": "Edit the controller-manager manifest to include RotateKubeletServerCertificate=true in the --feature-gates parameter.", - "NativeIaC": "", + "CLI": "--feature-gates='RotateKubeletServerCertificate=true'", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-for-controller-manager#kubernetes", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Data Security", - "Configuration Management" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.metadata.json index 4143e57c3a..893e932665 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "controllermanager_service_account_credentials", "CheckTitle": "Ensure that the --use-service-account-credentials argument is set to true", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "controller-manager", - "SubServiceName": "Service Account Credentials", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesControllerManager", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/", "Remediation": { "Code": { - "CLI": "Edit the controller-manager manifest to set the --use-service-account-credentials argument to true.", - "NativeIaC": "", + "CLI": "--use-service-account-credentials=true", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-use-service-account-credentials-argument-is-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security Best Practices", - "Access Control" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.metadata.json b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.metadata.json index 00c84e2506..86d0da987e 100644 --- a/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.metadata.json +++ b/prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "controllermanager_service_account_private_key_file", "CheckTitle": "Ensure that the --service-account-private-key-file argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "controller-manager", - "SubServiceName": "Service Account Private Key File Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesControllerManager", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/", "Remediation": { "Code": { - "CLI": "Edit the controller-manager manifest to set the --service-account-private-key-file argument to the appropriate private key file.", - "NativeIaC": "", + "CLI": "--service-account-private-key-file=/path/to/sa-key-file", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-service-account-private-key-file-argument-is-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Data Security", - "Configuration Management" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.metadata.json index ab58a25f1f..8945fe678c 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_admission_hostport_containers/core_minimize_admission_hostport_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_admission_hostport_containers", "CheckTitle": "Minimize the admission of containers which use HostPorts", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "HostPorts", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Network Security", - "Best Practices" + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.metadata.json index de2a47d094..b2efe2bbbb 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_admission_windows_hostprocess_containers/core_minimize_admission_windows_hostprocess_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_admission_windows_hostprocess_containers", "CheckTitle": "Minimize the admission of Windows HostProcess Containers", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Windows HostProcess Containers", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.metadata.json index c7605797e3..3081094803 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_allowPrivilegeEscalation_containers/core_minimize_allowPrivilegeEscalation_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_allowPrivilegeEscalation_containers", "CheckTitle": "Minimize the admission of containers with allowPrivilegeEscalation", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Privilege Escalation Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.metadata.json index e772750ce0..9adfd92311 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_containers_added_capabilities/core_minimize_containers_added_capabilities.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_containers_added_capabilities", "CheckTitle": "Minimize the admission of containers with added capabilities", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Capability Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.metadata.json index caed5424d0..a56a623620 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_containers_capabilities_assigned/core_minimize_containers_capabilities_assigned.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_containers_capabilities_assigned", "CheckTitle": "Minimize the admission of containers with capabilities assigned", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Capability Assignment", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.metadata.json index 024dea46b9..41ab085ca4 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_hostIPC_containers/core_minimize_hostIPC_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_hostIPC_containers", "CheckTitle": "Minimize the admission of containers wishing to share the host IPC namespace", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Host IPC Namespace", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.metadata.json index 0d0a3dbc6c..b4322c2ef6 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_hostNetwork_containers/core_minimize_hostNetwork_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_hostNetwork_containers", "CheckTitle": "Minimize the admission of containers wishing to share the host network namespace", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Host Network Namespace", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.metadata.json index e0ef50bc3b..7c96935665 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_hostPID_containers/core_minimize_hostPID_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_hostPID_containers", "CheckTitle": "Minimize the admission of containers wishing to share the host process ID namespace", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Host PID Namespace", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.metadata.json index 1bf45e3d2b..d47b03cc34 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_net_raw_capability_admission", "CheckTitle": "Minimize the admission of containers with the NET_RAW capability", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Capability Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.metadata.json index 26045f7fe4..0e247381b1 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_privileged_containers/core_minimize_privileged_containers.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_privileged_containers", "CheckTitle": "Minimize the admission of privileged containers", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Privileged Containers", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.metadata.json index 4e55018ce0..d51c7b165a 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_minimize_root_containers_admission/core_minimize_root_containers_admission.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_minimize_root_containers_admission", "CheckTitle": "Minimize the admission of root containers", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Root User Control", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.metadata.json b/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.metadata.json index 22bb99c2da..c7fd3b31db 100644 --- a/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_no_secrets_envs/core_no_secrets_envs.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_no_secrets_envs", "CheckTitle": "Prefer using secrets as files over secrets as environment variables", - "CheckType": [ - "Best Practice", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Secrets Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesSecrets", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security", - "Configuration Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.metadata.json b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.metadata.json index fb5e2a6196..b67f4f3468 100644 --- a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.metadata.json +++ b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "core_seccomp_profile_docker_default", "CheckTitle": "Ensure that the seccomp profile is set to docker/default in your pod definitions", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "core", - "SubServiceName": "Seccomp Profile", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesPod", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Container Security", - "Best Practices" + "container-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.metadata.json index ec1897096d..2b4801c588 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_client_cert_auth/etcd_client_cert_auth.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "etcd_client_cert_auth", "CheckTitle": "Ensure that the --client-cert-auth argument is set to true for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", - "SubServiceName": "Client Certificate Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "EtcdService", @@ -16,8 +13,8 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Edit the etcd pod specification file to set --client-cert-auth to true. Example: --client-cert-auth=\"true\".", - "NativeIaC": "", + "CLI": "--client-cert-auth=true", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-client-cert-auth-argument-is-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Access Control" + "encryption", + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.metadata.json index 2e49a94b42..92476a5bf7 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_no_auto_tls/etcd_no_auto_tls.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "etcd_no_auto_tls", "CheckTitle": "Ensure that the --auto-tls argument is not set to true for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", - "SubServiceName": "TLS Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "EtcdService", @@ -16,8 +13,8 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Edit the etcd pod specification file to set --auto-tls to false or remove the parameter. Example: --auto-tls=false.", - "NativeIaC": "", + "CLI": "--auto-tls=false", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-auto-tls-argument-is-not-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.metadata.json index 64ada44eef..589d143989 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_no_peer_auto_tls/etcd_no_peer_auto_tls.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "etcd_no_peer_auto_tls", "CheckTitle": "Ensure that the --peer-auto-tls argument is not set to true for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", - "SubServiceName": "Peer TLS Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "EtcdService", @@ -16,8 +13,8 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Configure etcd to avoid using self-signed certificates for peer connections by editing the etcd pod specification file with the --peer-auto-tls parameter set to false. Example: --peer-auto-tls=false.", - "NativeIaC": "", + "CLI": "--peer-auto-tls=false", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-peer-auto-tls-argument-is-not-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.metadata.json index fdd689bc38..825144a896 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_peer_client_cert_auth/etcd_peer_client_cert_auth.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "etcd_peer_client_cert_auth", "CheckTitle": "Ensure that the --peer-client-cert-auth argument is set to true for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", - "SubServiceName": "Peer Client Certificate Authentication", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "EtcdService", @@ -16,8 +13,8 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Configure peer client certificate authentication by editing the etcd pod specification file with the --peer-client-cert-auth parameter set to true. Example: --peer-client-cert-auth=true.", - "NativeIaC": "", + "CLI": "--peer-client-cert-auth=true", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-peer-client-cert-auth-argument-is-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.metadata.json index 7d66a369fc..586132ccab 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_peer_tls_config/etcd_peer_tls_config.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "etcd_peer_tls_config", "CheckTitle": "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", - "SubServiceName": "Peer TLS Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "EtcdService", @@ -16,8 +13,8 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Configure peer TLS encryption by editing the etcd pod specification file with appropriate certificate and key files. Example: --peer-client-file= --peer-key-file=.", - "NativeIaC": "", + "CLI": "--peer-client-file= --peer-key-file=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-peer-cert-file-and-peer-key-file-arguments-are-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.metadata.json index b272cd5e72..9cacb4781c 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_tls_encryption/etcd_tls_encryption.metadata.json @@ -2,10 +2,7 @@ "Provider": "kubernetes", "CheckID": "etcd_tls_encryption", "CheckTitle": "Ensure that the --cert-file and --key-file arguments are set as appropriate for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", "SubServiceName": "", "ResourceIdTemplate": "", @@ -16,8 +13,8 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the --cert-file and --key-file arguments appropriately.", - "NativeIaC": "", + "CLI": "--cert-file=/path/to/cert-file --key-file=/path/to/key-file", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-cert-file-and-key-file-arguments-are-set-as-appropriate", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Cluster Security", - "Data Protection" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.metadata.json b/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.metadata.json index 06ee066629..379253fa46 100644 --- a/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.metadata.json +++ b/prowler/providers/kubernetes/services/etcd/etcd_unique_ca/etcd_unique_ca.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "etcd_unique_ca", "CheckTitle": "Ensure that a unique Certificate Authority is used for etcd", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "etcd", - "SubServiceName": "Certificate Authority Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "EtcdService", @@ -16,7 +13,7 @@ "RelatedUrl": "https://etcd.io/docs/latest/op-guide/security/", "Remediation": { "Code": { - "CLI": "Configure etcd to use a unique CA by setting the --trusted-ca-file parameter in the etcd pod specification to point to the dedicated etcd CA file. Example: --trusted-ca-file=.", + "CLI": "--trusted-ca-file=", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Data Security", - "Configuration Management" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.metadata.json index e856b301f5..2eeced91ae 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_authorization_mode/kubelet_authorization_mode.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_authorization_mode", "CheckTitle": "Ensure that the kubelet --authorization-mode argument is not set to AlwaysAllow", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Authorization Mode", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/", "Remediation": { "Code": { - "CLI": "Edit the kubelet service file on each worker node to set --authorization-mode to Webhook.", + "CLI": "--authorization-mode=Webhook", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security", - "Node Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.metadata.json index bb3f28b79b..8e1f12207c 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_client_ca_file_set/kubelet_client_ca_file_set.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_client_ca_file_set", "CheckTitle": "Ensure that the kubelet --client-ca-file argument is set as appropriate", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Client CA File", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/", "Remediation": { "Code": { - "CLI": "Set the --client-ca-file argument in the kubelet service file on each worker node to the path of the client CA file.", + "CLI": "--client-ca-file=/path/to/ca-file", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security", - "Node Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.metadata.json index 71144f5520..cfed2832ad 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_ownership/kubelet_conf_file_ownership.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_conf_file_ownership", "CheckTitle": "Ensure kubelet.conf file ownership is set to root:root", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Config File Ownership", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesWorkerNode", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Compliance" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.metadata.json index 85d0b355c1..e155c3d5d2 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_conf_file_permissions/kubelet_conf_file_permissions.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_conf_file_permissions", "CheckTitle": "Ensure kubelet.conf file permissions are set to 600 or more restrictive", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Config File Permissions", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesWorkerNode", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Compliance" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.metadata.json index fc3fb8c98a..ffbc2a2980 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_ownership/kubelet_config_yaml_ownership.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_config_yaml_ownership", "CheckTitle": "Validate kubelet config.yaml File Ownership", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Config File Ownership", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesWorkerNode", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Compliance" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.metadata.json index 2f2b51767d..2b79d806be 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_config_yaml_permissions/kubelet_config_yaml_permissions.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_config_yaml_permissions", "CheckTitle": "Validate kubelet config.yaml File Permissions", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Config File Permissions", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesWorkerNode", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Compliance" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.metadata.json index d9523dfbe3..073a2839c3 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_anonymous_auth/kubelet_disable_anonymous_auth.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_disable_anonymous_auth", "CheckTitle": "Ensure that the --anonymous-auth argument is set to false", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Authentication Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/#kubelet-authorization", "Remediation": { "Code": { - "CLI": "Edit the kubelet configuration file or service file to set the --anonymous-auth argument to false. For service file: systemctl daemon-reload; systemctl restart kubelet.service", + "CLI": "--anonymous-auth=false", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security", - "Configuration Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.metadata.json index c61f601929..5e3b5b647e 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_disable_read_only_port/kubelet_disable_read_only_port.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_disable_read_only_port", "CheckTitle": "Verify that the kubelet --read-only-port argument is set to 0", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Read-Only Port Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/", "Remediation": { "Code": { - "CLI": "Set the --read-only-port argument in the kubelet service file on each worker node to 0.", - "NativeIaC": "", + "CLI": "--read-only-port=0", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-read-only-port-argument-is-set-to-0", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Security", - "Node Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.metadata.json index 25134e1c45..6783070718 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_event_record_qps/kubelet_event_record_qps.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_event_record_qps", "CheckTitle": "Ensure that the kubelet eventRecordQPS argument is set to an appropriate level", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Event Recording", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/", "Remediation": { "Code": { - "CLI": "Set the eventRecordQPS argument in the kubelet configuration file to an appropriate level that balances event capture with system performance.", - "NativeIaC": "", + "CLI": "--event-qps=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Event Logging", - "System Performance" + "logging" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.metadata.json index 6d7037163c..761e6fcf06 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_manage_iptables/kubelet_manage_iptables.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_manage_iptables", "CheckTitle": "Ensure that the kubelet --make-iptables-util-chains argument is set to true", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Iptables Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/", "Remediation": { "Code": { - "CLI": "Set the --make-iptables-util-chains argument in the kubelet service file on each worker node to true.", - "NativeIaC": "", + "CLI": "--make-iptables-util-chains=true", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-make-iptables-util-chains-argument-is-set-to-true", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Network Security", - "Node Management" + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.metadata.json index e4a5d9455c..bc98a81c7d 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_rotate_certificates/kubelet_rotate_certificates.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_rotate_certificates", "CheckTitle": "Ensure that the kubelet client certificate rotation is enabled", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Certificate Rotation", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/", "Remediation": { "Code": { - "CLI": "Ensure that the kubelet is configured with --rotate-certificates set to true or omitted (to use default).", - "NativeIaC": "", + "CLI": "--rotate-certificates=true", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-rotate-certificates-argument-is-not-set-to-false", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.metadata.json index 63a0bc8d63..a6c97d6f52 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_ownership_root/kubelet_service_file_ownership_root.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_service_file_ownership_root", "CheckTitle": "Ensure that the kubelet service file ownership is set to root:root", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Service File Ownership", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesWorkerNode", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Compliance" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.metadata.json index 0100ee79a8..84a7e68f19 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_service_file_permissions/kubelet_service_file_permissions.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_service_file_permissions", "CheckTitle": "Ensure that the kubelet service file permissions are set to 600 or more restrictive", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Kubelet Service File Permission", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesNode", @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Configuration Management" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.metadata.json index f2029a7bc9..c8e44b4edf 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_streaming_connection_timeout/kubelet_streaming_connection_timeout.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_streaming_connection_timeout", "CheckTitle": "Ensure that the kubelet --streaming-connection-idle-timeout argument is not set to 0", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "Streaming Connection Timeout", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/", "Remediation": { "Code": { - "CLI": "Set the --streaming-connection-idle-timeout argument in the kubelet service file on each worker node to a non-zero value.", - "NativeIaC": "", + "CLI": "--streaming-connection-idle-timeout=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-streaming-connection-idle-timeout-argument-is-not-set-to-0", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Node Security", - "Denial-of-Service Prevention" + "node-security" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.metadata.json index fdad472064..42dc06afde 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_strong_ciphers_only/kubelet_strong_ciphers_only.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_strong_ciphers_only", "CheckTitle": "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "TLS Cipher Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/", "Remediation": { "Code": { - "CLI": "Configure the kubelet to use only strong cryptographic ciphers by setting the --tls-cipher-suites parameter. Example: --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,...", - "NativeIaC": "", + "CLI": "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,...", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.metadata.json b/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.metadata.json index 86e52ac6af..c74151fd2c 100644 --- a/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.metadata.json +++ b/prowler/providers/kubernetes/services/kubelet/kubelet_tls_cert_and_key/kubelet_tls_cert_and_key.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "kubelet_tls_cert_and_key", "CheckTitle": "Ensure that the kubelet TLS certificate and private key are set appropriately", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "kubelet", - "SubServiceName": "TLS Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "KubernetesKubelet", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/", "Remediation": { "Code": { - "CLI": "Set the --tls-cert-file and --tls-private-key-file arguments in the kubelet configuration. Example: --tls-cert-file= --tls-private-key-file=.", - "NativeIaC": "", + "CLI": "--tls-cert-file= --tls-private-key-file=", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-tls-cert-file-and-tls-private-key-file-arguments-are-set-as-appropriate-for-kubelet", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Data Security", - "Network Security" + "encryption", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.metadata.json index 0758857972..b7d185dfb4 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_cluster_admin_usage/rbac_cluster_admin_usage.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_cluster_admin_usage", "CheckTitle": "Ensure that the cluster-admin role is only used where required", - "CheckType": [ - "Security", - "Compliance" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Authorization", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "ClusterRoleBinding", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles", "Remediation": { "Code": { - "CLI": "Review and, if necessary, modify the ClusterRoleBindings to limit the use of 'cluster-admin'. Use 'kubectl delete clusterrolebinding [name]' to remove unnecessary bindings.", + "CLI": "", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Least Privilege Principle" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.metadata.json index c0d74efcbb..aeecbb55e8 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_csr_approval_access", "CheckTitle": "Minimize access to the approval sub-resource of certificatesigningrequests objects", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "CSR Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "CertificateSigningRequestApproval", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#csrs-and-certificate-issuing", "Remediation": { "Code": { - "CLI": "Review and update RBAC configurations to restrict access to the approval sub-resource of CSR objects. Ensure that only trusted users or service accounts have the required permissions.", - "NativeIaC": "", + "CLI": "", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-clusterroles-that-grant-permissions-to-approve-certificatesigningrequests-are-minimized", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Privilege Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.metadata.json index b18048d10a..51706ec30d 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_node_proxy_subresource_access", "CheckTitle": "Minimize access to the proxy sub-resource of nodes", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Node Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "NodeProxySubResource", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#access-to-proxy-subresource-of-nodes", "Remediation": { "Code": { - "CLI": "Review and update RBAC configurations to restrict access to the proxy sub-resource of node objects. Ensure that only trusted users have the required permissions.", + "CLI": "", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Privilege Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.metadata.json index b7c7583c26..c4873e74bd 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pod_creation_access/rbac_minimize_pod_creation_access.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_pod_creation_access", "CheckTitle": "Minimize access to create pods", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Pod Creation Access Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Pod", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/", "Remediation": { "Code": { - "CLI": "Review and update RBAC settings to restrict pod creation access to necessary users only. Use `kubectl get clusterrolebindings -o yaml` and `kubectl get rolebindings --all-namespaces -o yaml` to identify users with pod creation privileges.", + "CLI": "", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Policy Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.metadata.json index dfc7db6e4c..e96f7fdaa8 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_pv_creation_access", "CheckTitle": "Minimize access to create persistent volumes", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Persistent Volume Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "PersistentVolume", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#persistent-volume-creation", "Remediation": { "Code": { - "CLI": "Review and update RBAC configurations to restrict creation access to PersistentVolume objects. Ensure that only trusted users have the required permissions.", + "CLI": "", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Privilege Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.metadata.json index dd8510fe2a..dc79c88c06 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_secret_access/rbac_minimize_secret_access.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_secret_access", "CheckTitle": "Minimize access to secrets", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Secrets Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Secrets", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/configuration/secret/", "Remediation": { "Code": { - "CLI": "Review and update RBAC configurations to restrict get, list, and watch permissions for secrets. Use Role and RoleBinding for namespace-specific access, and ClusterRole and ClusterRoleBinding for cluster-wide access.", - "NativeIaC": "", + "CLI": "", + "NativeIaC": "https://docs.bridgecrew.io/docs/no-serviceaccountnode-should-be-able-to-read-all-secrets", "Other": "", "Terraform": "" }, @@ -27,8 +24,8 @@ } }, "Categories": [ - "Access Control", - "Data Security" + "trustboundaries", + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.metadata.json index 40d27b41ca..1298c680ba 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_service_account_token_creation", "CheckTitle": "Minimize access to the service account token creation", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Service Account Token Creation", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "ServiceAccountToken", @@ -16,7 +13,7 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#token-request", "Remediation": { "Code": { - "CLI": "Review and update RBAC configurations to restrict access to the token sub-resource of serviceaccount objects. Ensure only trusted users or service accounts have necessary permissions.", + "CLI": "", "NativeIaC": "", "Other": "", "Terraform": "" @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Configuration Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.metadata.json index 4d51b1d9ae..52ab6487ec 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_webhook_config_access", "CheckTitle": "Minimize access to webhook configuration objects", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Webhook Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "WebhookConfiguration", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#control-admission-webhooks", "Remediation": { "Code": { - "CLI": "Review and update RBAC configurations to restrict access to validatingwebhookconfigurations and mutatingwebhookconfigurations. Ensure only trusted users or service accounts have necessary permissions.", - "NativeIaC": "", + "CLI": "", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-clusterroles-that-grant-control-over-validating-or-mutating-admission-webhook-configurations-are-minimized", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Configuration Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.metadata.json b/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.metadata.json index eea3a6e4d7..aa1fcd544b 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.metadata.json +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_wildcard_use_roles/rbac_minimize_wildcard_use_roles.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "rbac_minimize_wildcard_use_roles", "CheckTitle": "Minimize wildcard use in Roles and ClusterRoles", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "RBAC", - "SubServiceName": "Roles Management", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Role/ClusterRole", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/", "Remediation": { "Code": { - "CLI": "Review and update Roles and ClusterRoles to replace wildcards with specific resource names and actions. Use `kubectl get roles --all-namespaces -o yaml` and `kubectl get clusterroles -o yaml` to list current configurations.", - "NativeIaC": "", + "CLI": "", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-minimized-wildcard-use-in-roles-and-clusterroles", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Access Control", - "Policy Management" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.metadata.json b/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.metadata.json index 2ae81fdb1b..1b8d9667c8 100644 --- a/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.metadata.json +++ b/prowler/providers/kubernetes/services/scheduler/scheduler_bind_address/scheduler_bind_address.metadata.json @@ -2,12 +2,9 @@ "Provider": "kubernetes", "CheckID": "scheduler_bind_address", "CheckTitle": "Ensure that the --bind-address argument is set to 127.0.0.1 for the Scheduler", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckType": [], "ServiceName": "scheduler", - "SubServiceName": "Bind Address Configuration", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "KubernetesScheduler", @@ -16,8 +13,8 @@ "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/", "Remediation": { "Code": { - "CLI": "Edit the kube-scheduler configuration to set --bind-address to 127.0.0.1.", - "NativeIaC": "", + "CLI": "--bind-address=127.0.0.1", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-bind-address-argument-is-set-to-127001-1", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Network Security", - "Configuration Management" + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.metadata.json b/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.metadata.json index bf9943f24b..5048cbda82 100644 --- a/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.metadata.json +++ b/prowler/providers/kubernetes/services/scheduler/scheduler_profiling/scheduler_profiling.metadata.json @@ -2,10 +2,7 @@ "Provider": "kubernetes", "CheckID": "scheduler_profiling", "CheckTitle": "Ensure that the --profiling argument is set to false", - "CheckType": [ - "Cluster Performance", - "Cluster Security" - ], + "CheckType": [], "ServiceName": "scheduler", "SubServiceName": "", "ResourceIdTemplate": "", @@ -16,8 +13,8 @@ "RelatedUrl": "https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md", "Remediation": { "Code": { - "CLI": "Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml and set --profiling=false", - "NativeIaC": "", + "CLI": "--profiling=false", + "NativeIaC": "https://docs.bridgecrew.io/docs/ensure-that-the-profiling-argument-is-set-to-false-2", "Other": "", "Terraform": "" }, @@ -27,8 +24,7 @@ } }, "Categories": [ - "Performance Optimization", - "Security Best Practices" + "trustboundaries" ], "DependsOn": [], "RelatedTo": [],