Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CIS K8s boolean cli arguments rules perform case sensitive check #2007

Open
moukoublen opened this issue Mar 6, 2024 · 0 comments
Open

CIS K8s boolean cli arguments rules perform case sensitive check #2007

moukoublen opened this issue Mar 6, 2024 · 0 comments
Assignees
Labels
8.15 candidate bug Something isn't working good first issue Good for newcomers Team:Cloud Security Cloud Security team related

Comments

@moukoublen
Copy link
Member

moukoublen commented Mar 6, 2024

Describe the bug
CIS K8s rules:

1.2.18: Verify that the --profiling argument is set to false for kube-apiserver.
1.3.2: Verify that the --profiling argument is set to false for kube-controller-manager.
1.4.1: Verify that the --profiling argument is set to false for kube-scheduler.
2.2: Verify that the --client-cert-auth argument is set to true for etcd.

Evaluate to fail when the boolean values are True/False.

Preconditions
A k8s cluster with updated the mentioned arguments in control plane to have True/False value.
Config files:

  • /etc/kubernetes/manifests/kube-apiserver.yaml
  • /etc/kubernetes/manifests/kube-controller-manager.yaml
  • /etc/kubernetes/manifests/kube-scheduler.yaml
  • /etc/kubernetes/manifests/etcd.yaml

To Reproduce
Write the exact actions one should perform in order to reproduce the bug.
Steps to reproduce the behavior:

  1. Install kspm in this cluster

Expected behavior
Those rules should pass with boolean values in this format True/False.

Technically the cli boolean flag parsing happens with strconv.ParseBool in all cases.

strconv.ParseBool accepts these values:

  • "1", "t", "T", "true", "TRUE", "True" as true
  • "0", "f", "F", "false", "FALSE", "False" as false
@moukoublen moukoublen added bug Something isn't working Team:Cloud Security Cloud Security team related good first issue Good for newcomers labels Mar 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.15 candidate bug Something isn't working good first issue Good for newcomers Team:Cloud Security Cloud Security team related
Projects
None yet
Development

No branches or pull requests

2 participants