Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[2.7] Improve security-scan's e2e validation with yamllint and kube-bench dry-run #244

Closed
samjustus opened this issue Dec 19, 2023 · 1 comment

Comments

@samjustus
Copy link

samjustus commented Dec 19, 2023

backport #227

@rishabhmsra
Copy link

rishabhmsra commented Jan 19, 2024

Validated on rancher v2.7-head. Provisioned RKE1, RKE2 and K3s clusters using below k8s versions:

  • v1.23
  • v1.24
  • v1.25
  • v1.26

Ran the scans using respective profiles on all the clusters, all scan passed except below failures which are expected and will be release noted:

RKE1 k8s v1.26 hardened:

Mixed
4.1.7	Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)

RKE2 k8s v1.26 Failures in node driver, custom, local(non-hardened) clusters:

Fail
1.1.1	Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)
Fail
1.1.3	Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
Fail
1.1.5	Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)
Fail
1.1.7	Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)

RKE2 k8s v1.24 failures:

Fail
1.1.3	Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
Fail
1.1.5	Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants