/usr/local/bin/kube_master_ocp_4_3.tmpl

# ------------------------------------------------------------------------------
# Kubernetes CIS benchmark
#
# NeuVector, Inc. (c) 2020-
#
# NeuVector delivers an application and network intelligent container security
# solution that automatically adapts to protect running containers. Don’t let
# security concerns slow down your CI/CD processes.
# ------------------------------------------------------------------------------

[INFO] 1 - Control Plane Components
[INFO] 1.1 - Master Node Configuration Files
[INFO][Level 1][Scored] 1.1.1  - Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)
[INFO]      * File not found
[INFO][Level 1][Scored] 1.1.2  - Ensure that the API server pod specification file ownership is set to root:root (Scored)
[INFO][Level 1][Scored] 1.1.3  - Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)
[INFO]      * File not found
[INFO][Level 1][Scored] 1.1.4  - Ensure that the controller manager pod specification file ownership is set to root:root (Scored)
[INFO][Level 1][Scored] 1.1.5  - Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)
[INFO]      * File not found
[INFO][Level 1][Scored] 1.1.6  - Ensure that the scheduler pod specification file ownership is set to root:root (Scored)
[INFO][Level 1][Scored] 1.1.7  - Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)
[INFO]      * File not found
[INFO][Level 1][Scored] 1.1.8  - Ensure that the etcd pod specification file ownership is set to root:root (Scored)
[PASS][Level 1][Not Scored] 1.1.9  - Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
[PASS][Level 1][Not Scored] 1.1.10  - Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
[INFO][Level 1][Scored] 1.1.11  - Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
[INFO][Level 1][Scored] 1.1.12  - Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
[INFO][Level 1][Scored] 1.1.13  - Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
[INFO]      * File not found
[INFO][Level 1][Scored] 1.1.14  - Ensure that the admin.conf file ownership is set to root:root (Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Scored] 1.1.15  - Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Scored] 1.1.16  - Ensure that the scheduler.conf file ownership is set to root:root (Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Scored] 1.1.17  - Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Scored] 1.1.18  - Ensure that the controller-manager.conf file ownership is set to root:root (Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Scored] 1.1.19  - Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Not Scored] 1.1.20  - Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Not Scored)
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 1][Not Scored] 1.1.21  - Ensure that the Kubernetes PKI key file permissions are set to 600 (Not Scored)
[INFO] 1.2 - API Server
[WARN][Level 1][Not Scored] 1.2.1  - Allows anonymous requests to the API server to support information discovery and webhook integrations. Anonymous requests are assigned the system:unauthenticated group, which is bound to cluster-scoped roles (Not Scored)
[WARN][Level 1][Scored] 1.2.2  - Ensure that the basic-auth-file method is not enabled (Scored)
[WARN][Level 1][Scored] 1.2.3  - Ensure that the token-auth-file flag is not used (Scored)
[WARN][Level 1][Scored] 1.2.4  - Ensure that control-plane components utilize X.509 certificates for authentication (Scored)
[WARN][Level 1][Scored] 1.2.5  - Ensure that X.509 certificates are utilized for the secure connections between API server and node/kubelet (Scored)
[WARN][Level 1][Scored] 1.2.6  - Ensure that X.509 certificates are utilized for authentication of the control-plane components (Scored)
[WARN][Level 1][Scored] 1.2.7  - Ensure to use RBAC to authorize requests and actions a user is allowed to perform in an OpenShift cluster (Scored)
[WARN][Level 1][Scored] 1.2.8  - Ensure that the Node authorizer is enabled (Scored)
[WARN][Level 1][Scored] 1.2.9  - Ensure to use RBAC to authorize requests and actions a user is allowed to perform in an OpenShift cluster (Scored)
[PASS][Level 1][Not Scored] 1.2.10  - Ensure that the kubelet sends fewer events for preventing requests flooding at the API server (Not Scored)
[PASS][Level 1][Scored] 1.2.11  - Ensure that AlwaysAdmit admission control plugin is not enabled (Scored)
[PASS][Level 1][Not Scored] 1.2.12  - Ensure that the admission control plugin AlwaysPullImages is set (Not Scored)
[WARN][Level 1][Not Scored] 1.2.13  - Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored)
[PASS][Level 1][Scored] 1.2.14  - Ensure that the admission control plugin ServiceAccount is set (Scored)
[PASS][Level 1][Scored] 1.2.15  - Ensure that the admission control plugin NamespaceLifecycle is set (Scored)
[WARN][Level 1][Scored] 1.2.16  - Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
[PASS][Level 1][Scored] 1.2.17  - Ensure that the admission control plugin NodeRestriction is set (Scored)
[WARN][Level 1][Scored] 1.2.18  - Ensure that the --insecure-bind-address argument is not set (Scored)
[WARN][Level 1][Scored] 1.2.19  - Ensure that the --insecure-port argument is set to 0 (Scored)
[WARN][Level 1][Scored] 1.2.20  - Ensure that the --secure-port argument is not set to 0 (Scored)
[WARN][Level 1][Scored] 1.2.21  - Ensure that the --profiling argument is set to false (Scored)
[WARN][Level 1][Scored] 1.2.22  - Ensure that the --audit-log-path argument is set (Scored)
[WARN][Level 1][Scored] 1.2.23  - Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
[WARN][Level 1][Scored] 1.2.24  - Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
[WARN][Level 1][Scored] 1.2.25  - Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
sh: bad number
[WARN][Level 1][Scored] 1.2.26  - Ensure that the --request-timeout argument is set as appropriate (Scored)
[INFO][Level 1][Scored] 1.2.27  - Ensure that the --service-account-lookup argument is set to true (Scored)
      OpenShift denies access for any OAuth Access token that does not exist in its etcd data store.
      OpenShift does not use the service-account-lookup flag.
[WARN][Level 1][Scored] 1.2.28  - Ensure that the --service-account-key-file argument is set as appropriate (Scored)
[WARN][Level 1][Scored] 1.2.29  - Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
[WARN][Level 1][Scored] 1.2.30  - Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
[WARN][Level 1][Scored] 1.2.31  - Ensure that the --client-ca-file argument is set as appropriate (Scored)
[WARN][Level 1][Scored] 1.2.32  - Ensure that the --etcd-cafile argument is set as appropriate (Scored)
[WARN][Level 1][Not Scored] 1.2.33  - Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)
[WARN][Level 1][Not Scored] 1.2.34  - Ensure that encryption providers are appropriately configured (Not Scored)
[WARN][Level 1][Not Scored] 1.2.35  - Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
[INFO] 1.3 - Controller Manager
[INFO][Level 1][Not Scored] 1.3.1  - Ensure that imageMinimumGCAge, imageGCHighThresholdPercent, imageGCLowThresholdPercent are set as appropriate (Not Scored)
[INFO] Container garbage collection is enabled by default and happens automatically in response to eviction thresholds being reached. OpenShift does not set the terminated-pod-gc-threshold value differently from the Kubernetes default of 12500. You may need to adjust this value based on your cluster resources.
Need to confirm the above. Try checking the default machine config pool for worker nodes
[INFO][Level 1][Scored] 1.3.2  - Ensure that the profiling is secured with RBAC and is only available to cluster administrators (Scored)
[INFO] OpenShift uses profiling by default but it is secured with authentication and authorization and is only available to cluster administrators.The Kubernetes Controller Manager operator manages and updates the Kubernetes Controller Manager deployed on top of OpenShift. This operator is configured via KubeControllerManager custom resource. By default, the operator exposes Prometheus metrics via metrics service. The metrics are collected from the Kubernetes Controller Manager operator.
[WARN][Level 1][Scored] 1.3.3  - Ensure that the --use-service-account-credentials argument is set to true (Scored)
[WARN][Level 1][Scored] 1.3.4  - Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
[WARN][Level 1][Scored] 1.3.5  - Ensure that the --root-ca-file argument is set as appropriate (Scored)
[WARN][Level 2][Scored] 1.3.6  - Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
[WARN][Level 1][Scored] 1.3.7  - Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
[INFO] 1.4 - Scheduler
[PASS][Level 1][Scored] 1.4.2  - Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
[INFO] 2 - etcd
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[WARN][Level 1][Scored] 2.1  - Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[WARN][Level 2][Scored] 2.2  - Ensure that the --client-cert-auth argument is set to true (Scored)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[PASS][Level 1][Scored] 2.3  - Ensure that the --auto-tls argument is not set to true (Scored)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[WARN][Level 1][Scored] 2.4  - Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[WARN][Level 1][Scored] 2.5  - Ensure that the --peer-client-cert-auth argument is set to true (Scored)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[PASS][Level 2][Scored] 2.6  - Ensure that the --peer-auto-tls argument is not set to true (Scored)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-member.yaml: No such file or directory
[WARN][Level 2][Not Scored] 2.7  - Ensure that a unique Certificate Authority is used for etcd (Not Scored)
[INFO] 3 - Control Plane Configuration
[INFO] 3.1 - Authentication and Authorization
find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory
[WARN][Level 2][Not Scored] 3.1.1  - Client certificate authentication should not be used for users (Not Scored)
[INFO] 3.2 - Logging
[WARN][Level 1][Scored] 3.2.1 - Ensure that a minimal audit policy is created (Scored)
[WARN][Level 2][Not Scored] 3.2.2 - Ensure that the audit policy covers key security concerns (Not Scored)
[INFO] 5 - Policies
[INFO] 5.1 - RBAC and Service Accounts
/usr/local/bin/kube_master_ocp_4_3.tmpl: line 1186: kubectl: not found
[INFO][Level 1][Not Scored] 5.1.1  - Ensure that the cluster-admin role is only used where required (Not Scored)
/usr/local/bin/kube_master_ocp_4_3.tmpl: line 1193: kubectl: not found
[INFO][Level 1][Not Scored] 5.1.2  - Minimize access to secrets (Not Scored)
/usr/local/bin/kube_master_ocp_4_3.tmpl: line 1200: kubectl: not found
[INFO][Level 1][Not Scored] 5.1.3  - Create administrative boundaries between resources using namespaces (Not Scored)
/usr/local/bin/kube_master_ocp_4_3.tmpl: line 1207: kubectl: not found
[INFO][Level 1][Not Scored] 5.1.4  - Create network segmentation using Network Policies (Not Scored)
/usr/local/bin/kube_master_ocp_4_3.tmpl: line 1214: kubectl: not found
[INFO][Level 1][Not Scored] 5.1.5  - Avoid using Kubernetes Secrets (Not Scored)
[INFO][Level 1][Not Scored] 5.1.6  - Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)
[INFO][Level 1][Not Scored] 5.1.7  - Apply Security Context to Your Pods and Containers (Not Scored)
[INFO][Level 1][Not Scored] 5.1.8  - Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)
[INFO][Level 1][Not Scored] 5.1.9  - Place compensating controls in the form of PSP and RBAC for privileged containers usage (Not Scored)
[INFO] 5.2 - Pod Security Policies
[INFO][Level 1][Not Scored] 5.2.1  - Minimize the admission of privileged containers (Not Scored)
[INFO][Level 1][Scored] 5.2.2  - Minimize the admission of containers wishing to share the host process ID namespace (Scored)
[INFO][Level 1][Scored] 5.2.3  - Minimize the admission of containers wishing to share the host IPC namespace (Scored)
[INFO][Level 1][Scored] 5.2.4  - Minimize the admission of containers wishing to share the host network namespace (Scored)
[INFO][Level 1][Scored] 5.2.5  - Minimize the admission of containers with allowPrivilegeEscalation (Scored)
[INFO][Level 2][Not Scored] 5.2.6  - Minimize the admission of root containers (Not Scored)
[INFO][Level 1][Not Scored] 5.2.7  - Minimize the admission of containers with the NET_RAW capability (Not Scored)
[INFO][Level 1][Not Scored] 5.2.8  - Minimize the admission of containers with added capabilities (Not Scored)
[INFO][Level 2][Not Scored] 5.2.9  - Minimize the admission of containers with capabilities assigned (Not Scored)
[INFO] 5.3 - Network Policies and CNI
[INFO][Level 1][Not Scored] 5.3.1  - Ensure that the CNI in use supports Network Policies (Not Scored)
[INFO][Level 2][Scored] 5.3.2  - Ensure that all Namespaces have Network Policies defined (Scored)
[INFO] 5.4 - Secrets Management
[INFO][Level 1][Not Scored] 5.4.1  - Prefer using secrets as files over secrets as environment variables (Not Scored)
[INFO][Level 2][Not Scored] 5.4.2  - Consider external secret storage (Not Scored)
[INFO] 5.5 - Extensible Admission Control
[INFO][Level 2][Not Scored] 5.5.1  - Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)
[INFO] 5.6 - General Policies
[INFO][Level 1][Not Scored] 5.6.1  - Create administrative boundaries between resources using namespaces (Not Scored)
[INFO][Level 2][Not Scored] 5.6.2  - Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)
[INFO][Level 2][Not Scored] 5.6.3  - Apply Security Context to Your Pods and Containers (Not Scored)
[INFO][Level 2][Scored] 5.6.4  - The default namespace should not be used (Scored)