Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CIS Node 4.2.3 - add template to kubelet_configure_client_ca/rule.yml #6213

Merged
merged 1 commit into from
Oct 13, 2020
Merged

CIS Node 4.2.3 - add template to kubelet_configure_client_ca/rule.yml #6213

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
19 changes: 19 additions & 0 deletions applications/openshift/kubelet/kubelet_configure_client_ca/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,3 +52,22 @@ identifiers:
references:
cis@ocp3: 2.1.4
cis@ocp4: 4.2.3

template:
{{%- if product == "ocp4" %}}
name: yamlfile_value
vars:
filepath: /etc/kubernetes/kubelet.conf
yamlpath: ".authentication.x509.clientCAFile"
values:
- value: "/etc/kubernetes/kubelet-ca.crt"
operation: "equals"
{{% else %}}
name: yamlfile_value
vars:
filepath: /etc/origin/node/node-config.yaml
yamlpath: ".servingInfo.clientCA"
values:
- value: "client-ca.crt"
operation: "equals"
{{%- endif %}}
2 changes: 1 addition & 1 deletion ocp4/profiles/cis-node.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ selections:
# 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow
# - this seems to be the default in the code, so the rule should verify that authorization mode is NOT set to AlwaysAllow
# 4.2.3 Ensure that the --client-ca-file argument is set as appropriate
# - like kubelet_anonymous_auth_disabled but check for authentication.x509.clientCAFile=/etc/kubernetes/kubelet-ca.crt
- kubelet_configure_client_ca
# 4.2.4 Ensure that the --read-only-port argument is set to 0
# - this is a platform rule (reads from a CM)
# 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0
Expand Down