Bloodhound changes #665
Bloodhound changes #665
Conversation
rpkelly
force-pushed
the
bloodhound-changes
branch
5 times, most recently
from
66e17a2 to
cc2e11b
Compare
|
Q - could you explain on the failed tests in |
|
@ytsssun The fails are expected. I did not set the image to be L2 CIS compliant, I only wanted to validate that the overrides were being properly read. |
|
The formatting for this line is wonky in plain text output: Ideally we'd format it more like: |
rpkelly
force-pushed
the
bloodhound-changes
branch
from
cc2e11b to
0dd21ce
Compare
|
Added updated code, will rebuild and run a test image to show the new output next |
rpkelly
force-pushed
the
bloodhound-changes
branch
from
0dd21ce to
c34ff53
Compare
|
Updated test output has been added |
| { | ||
| "reason": "Test requires iptables FORWARD chain configuration that conflicts with Kubernetes networking architecture. Kubernetes manages its own iptables rules through kube-proxy and CNI plugins.", | ||
| "reference": "https://github.com/bottlerocket-os/bottlerocket/issues/540", | ||
| "status": "SKIP" | ||
| } |
There was a problem hiding this comment.
Do we also need an override for the IPv6 check, 3.4.2.1?
There was a problem hiding this comment.
Per #540 3.4.2.1 actually does pass if properly configured, as we only seem to override the IPv4 rules.
There was a problem hiding this comment.
Per #540 3.4.2.1 actually does pass if properly configured, as we only seem to override the IPv4 rules.
But does the node actually work properly if using IPv6 for the overlay network, with forwarding disabled? I'm not sure why that would be true for IPv6 but not true for IPv4.
rpkelly
force-pushed
the
bloodhound-changes
branch
from
c34ff53 to
0ade908
Compare
Add override system to skip specific compliance tests through JSON configuration files. Enables variants to skip incompatible tests while maintaining compliance checking. Signed-off-by: Richard Kelly <[email protected]>
Replace ManualChecker with actual K8S04021000Checker implementation and add override to pass on Bottlerocket. Signed-off-by: Richard Kelly <[email protected]>
Remove TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 from allowed cipher suites per latest Kubernetes CIS benchmark. Signed-off-by: Richard Kelly <[email protected]>
rpkelly
force-pushed
the
bloodhound-changes
branch
from
0ade908 to
cba0a94
Compare
| %package -n %{_cross_os}bloodhound-k8s-overrides | ||
| Summary: CIS Test overrides for Kubernetes variants | ||
| Requires: (%{_cross_os}bloodhound and %{_cross_os}variant-runtime(k8s)) | ||
| %description -n %{_cross_os}bloodhound-k8s-overrides | ||
| %{summary}. |
There was a problem hiding this comment.
nit: can just add these into the existing bloodhound-k8s subpackage which has the same requirements
The added test overrides do not directly flatten into the previous json output structure. In order to maintain the same json structure we require a custom serializer Signed-off-by: Richard Kelly <[email protected]>
3 participants
Issue number:
Closes #540
Description of changes:
Adds the ability for bloodhound test overrides to exist, with reasoning, and optional messaging in the case of skipped tests. Additionally, overrides 2 tests:
Finally, we've removed the RSA ciphers no longer considered secure by the latest kubernetes CIS benchmark from k8s 04021200
Testing done:
Run tests:
Check to ensure overrides are on kubernetes variants, but not ECS variants:
json output sample:
Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.