Add GKE 1.6 CIS benchmark for GCP environment (aquasecurity#1672)

* Add config entries for GKE 1.6 controls * Add gke1.6 control plane recommendations * Add gke-1.6.0 worker node recommendations * Add gke-1.6.0 policy recommendations * Add managed services and policy recommendation * Add master recommendations * Fix formatting across gke-1.6.0 files * Add gke-1.6.0 benchmark selection based on k8s version * Workaround: hardcode kubelet config path for gke-1.6.0 * Fix tests for makeIPTablesUtilChaings * Change scored field for all node tests to true * Fix kubelet file permission to check for --------- Co-authored-by: afdesk <[email protected]>
VoerEirAB · Oct 14, 2024 · 368cf45 · 368cf45
1 parent fa22df1
commit 368cf45
Show file tree

Hide file tree

Showing 11 changed files with 1,431 additions and 23 deletions.
diff --git a/cfg/config.yaml b/cfg/config.yaml
@@ -288,6 +288,7 @@ version_mapping:
   "eks-1.2.0": "eks-1.2.0"
   "gke-1.0": "gke-1.0"
   "gke-1.2.0": "gke-1.2.0"
+  "gke-1.6.0": "gke-1.6.0"
   "ocp-3.10": "rh-0.7"
   "ocp-3.11": "rh-0.7"
   "ocp-4.0": "rh-1.0"
@@ -381,6 +382,12 @@ target_mapping:
     - "controlplane"
     - "policies"
     - "managedservices"
+  "gke-1.6.0":
+    - "master"
+    - "node"
+    - "controlplane"
+    - "policies"
+    - "managedservices"
   "eks-1.0.1":
     - "master"
     - "node"

diff --git a/cfg/gke-1.6.0/config.yaml b/cfg/gke-1.6.0/config.yaml
@@ -0,0 +1,9 @@
+---
+## Version-specific settings that override the values in cfg/config.yaml
+
+node:
+  proxy:
+    defaultkubeconfig: "/var/lib/kubelet/kubeconfig"
+
+  kubelet:
+    defaultconf: "/etc/kubernetes/kubelet/kubelet-config.yaml"
diff --git a/cfg/gke-1.6.0/controlplane.yaml b/cfg/gke-1.6.0/controlplane.yaml
@@ -0,0 +1,20 @@
+---
+controls:
+version: "gke-1.6.0"
+id: 2
+text: "Control Plane Configuration"
+type: "controlplane"
+groups:
+  - id: 2.1
+    text: "Authentication and Authorization"
+    checks:
+      - id: 2.1.1
+        text: "Client certificate authentication should not be used for users (Manual)"
+        type: "manual"
+        remediation: |
+          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
+          implemented in place of client certificates.
+
+          You can remediate the availability of client certificates in your GKE cluster. See
+          Recommendation 5.8.1.
+        scored: false