Skip to content

Commit ed3c88f

Browse files
slashbenslashben
authored
Fixing two issues (CIS 1.2.3 and C-0030 were implemented incorrectly) (#664)
* Fixing 1.2.3 in CIS Signed-off-by: Ben <[email protected]> * Fixing "Control C-0030 fails on NetworkPolicies with only Ingress or Egress" Signed-off-by: Ben <[email protected]> --------- Signed-off-by: Ben <[email protected]>
1 parent 90243de commit ed3c88f

File tree

13 files changed

+645
-8
lines changed

13 files changed

+645
-8
lines changed

‎controls/C-0283-ensurethattheapiserverdenyserviceexternalipsisset.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"controlID": "C-0283",
3+
"name": "Ensure that the API Server --DenyServiceExternalIPs is set",
4+
"description": "This admission controller rejects all net-new usage of the Service field externalIPs.",
5+
"long_description": "This admission controller rejects all net-new usage of the Service field externalIPs. This feature is very powerful (allows network traffic interception) and not well controlled by policy. When enabled, users of the cluster may not create new Services which use externalIPs and may not add new values to externalIPs on existing Service objects. Existing uses of externalIPs are not affected, and users may remove values from externalIPs on existing Service objects.\n\n Most users do not need this feature at all, and cluster admins should consider disabling it. Clusters that do need to use this feature should consider using some custom policy to manage usage of it.",
6+
"remediation": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and add the `--enable-admission-plugins=DenyServiceExternalIPs` parameter\n\n or\n\n The Kubernetes API server flag disable-admission-plugins takes a comma-delimited list of admission control plugins to be disabled, even if they are in the list of plugins enabled by default.\n\n `kube-apiserver --disable-admission-plugins=DenyServiceExternalIPs,AlwaysDeny ...`",
7+
"manual_test": "Run the following command on the Control Plane node:\n\n \n```\nps -ef | grep kube-apiserver\n\n```\n Verify that the `--enable-admission-plugins=DenyServiceExternalIPs argument exists.",
8+
"references": [
9+
"https://workbench.cisecurity.org/sections/2633389/recommendations/4261958"
10+
],
11+
"attributes": {
12+
},
13+
"rulesNames": [
14+
"ensure-that-the-api-server-DenyServiceExternalIPs-is-set"
15+
],
16+
"baseScore": 4,
17+
"impact_statement": "When not enabled, users of the cluster may create new Services which use externalIPs and may add new values to externalIPs on existing Service objects.",
18+
"default_value": "By default, `--enable-admission-plugins=DenyServiceExternalIPs` argument is not set.",
19+
"category": {
20+
"name" : "Control plane"
21+
},
22+
"scanningScope": {
23+
"matches": [
24+
"cluster"
25+
]
26+
}
27+
}

‎rules/ensure-that-the-api-server-DenyServiceExternalIPs-is-set/filter.rego

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package armo_builtins
2+
3+
deny[msg] {
4+
obj = input[_]
5+
is_api_server(obj)
6+
msg := {"alertObject": {"k8sApiObjects": [obj]}}
7+
}
8+
9+
is_api_server(obj) {
10+
obj.apiVersion == "v1"
11+
obj.kind == "Pod"
12+
obj.metadata.namespace == "kube-system"
13+
count(obj.spec.containers) == 1
14+
count(obj.spec.containers[0].command) > 0
15+
endswith(obj.spec.containers[0].command[0], "kube-apiserver")
16+
}

‎rules/ensure-that-the-api-server-DenyServiceExternalIPs-is-set/raw.rego

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package armo_builtins
2+
3+
import future.keywords.in
4+
5+
deny[msg] {
6+
obj = input[_]
7+
is_api_server(obj)
8+
result = invalid_flag(obj.spec.containers[0].command)
9+
msg := {
10+
"alertMessage": "admission control plugin DenyServiceExternalIPs is not enabled.",
11+
"alertScore": 2,
12+
"reviewPaths": result.failed_paths,
13+
"failedPaths": result.failed_paths,
14+
"fixPaths": result.fix_paths,
15+
"packagename": "armo_builtins",
16+
"alertObject": {"k8sApiObjects": [obj]},
17+
}
18+
}
19+
20+
is_api_server(obj) {
21+
obj.apiVersion == "v1"
22+
obj.kind == "Pod"
23+
obj.metadata.namespace == "kube-system"
24+
count(obj.spec.containers) == 1
25+
count(obj.spec.containers[0].command) > 0
26+
endswith(obj.spec.containers[0].command[0], "kube-apiserver")
27+
}
28+
29+
get_flag_values(cmd) = {"origin": origin, "values": values} {
30+
re := " ?--enable-admission-plugins=(.+?)(?: |$)"
31+
matchs := regex.find_all_string_submatch_n(re, cmd, -1)
32+
count(matchs) == 1
33+
values := [val | val := split(matchs[0][1], ",")[j]; val != ""]
34+
origin := matchs[0][0]
35+
}
36+
37+
# Assume flag set only once
38+
invalid_flag(cmd) = result {
39+
flag := get_flag_values(cmd[i])
40+
41+
# value check
42+
not "DenyServiceExternalIPs" in flag.values
43+
44+
# get fixed and failed paths
45+
result = get_retsult(i)
46+
}
47+
48+
get_retsult(i) = result {
49+
path = sprintf("spec.containers[0].command[%v]", [i])
50+
result = {
51+
"failed_paths": [path],
52+
"fix_paths": [{
53+
"path": path,
54+
"value": sprintf("--enable-admission-plugins=%v", ["DenyServiceExternalIPs"]),
55+
}],
56+
}
57+
}

‎rules/ensure-that-the-api-server-DenyServiceExternalIPs-is-set/rule.metadata.json

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"name": "ensure-that-the-api-server-DenyServiceExternalIPs-is-set",
3+
"attributes": {
4+
},
5+
"ruleLanguage": "Rego",
6+
"match": [
7+
{
8+
"apiGroups": [
9+
""
10+
],
11+
"apiVersions": [
12+
"v1"
13+
],
14+
"resources": [
15+
"Pod"
16+
]
17+
}
18+
],
19+
"dynamicMatch": [],
20+
"ruleDependencies": [],
21+
"description": "This admission controller rejects all net-new usage of the Service field externalIPs.",
22+
"remediation": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and add the `--enable-admission-plugins=DenyServiceExternalIPs` parameter\n\n or\n\n The Kubernetes API server flag disable-admission-plugins takes a comma-delimited list of admission control plugins to be disabled, even if they are in the list of plugins enabled by default.\n\n `kube-apiserver --disable-admission-plugins=DenyServiceExternalIPs,AlwaysDeny ...`\n\n#### Impact Statement\nWhen enabled, users of the cluster may not create new Services which use externalIPs and may not add new values to externalIPs on existing Service objects.\n\n#### Default Value\nBy default, `--token-auth-file` argument is not set.",
23+
"ruleQuery": ""
24+
}

‎rules/ensure-that-the-api-server-DenyServiceExternalIPs-is-set/test/failed/expected.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
[
2+
{
3+
"alertMessage": "admission control plugin DenyServiceExternalIPs is not enabled.",
4+
"failedPaths": [
5+
"spec.containers[0].command[5]"
6+
],
7+
"reviewPaths": [
8+
"spec.containers[0].command[5]"
9+
],
10+
"deletePaths": null,
11+
"fixPaths": [
12+
{
13+
"path": "spec.containers[0].command[5]",
14+
"value": "--enable-admission-plugins=DenyServiceExternalIPs"
15+
}
16+
],
17+
"ruleStatus": "",
18+
"packagename": "armo_builtins",
19+
"alertScore": 2,
20+
"alertObject": {
21+
"k8sApiObjects": [
22+
{
23+
"apiVersion": "v1",
24+
"kind": "Pod",
25+
"metadata": {
26+
"labels": {
27+
"component": "kube-apiserver",
28+
"tier": "control-plane"
29+
},
30+
"name": "kube-apiserver-minikube"
31+
}
32+
}
33+
]
34+
}
35+
}
36+
]

‎rules/ensure-that-the-api-server-DenyServiceExternalIPs-is-set/test/failed/input/1.yaml

+153
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
annotations:
5+
kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 192.168.49.2:8443
6+
kubernetes.io/config.hash: 6580cebb2d04c6c59385cf58e278b0a6
7+
kubernetes.io/config.mirror: 6580cebb2d04c6c59385cf58e278b0a6
8+
kubernetes.io/config.seen: '2022-07-04T06:44:17.243525710Z'
9+
kubernetes.io/config.source: file
10+
seccomp.security.alpha.kubernetes.io/pod: runtime/default
11+
creationTimestamp: '2022-07-04T06:44:17Z'
12+
labels:
13+
component: kube-apiserver
14+
tier: control-plane
15+
name: kube-apiserver-minikube
16+
namespace: kube-system
17+
ownerReferences:
18+
- apiVersion: v1
19+
controller: true
20+
kind: Node
21+
name: minikube
22+
uid: 8bb39b2c-8cb0-4390-94e6-74d5e3fe7c16
23+
resourceVersion: '257649'
24+
uid: 2ca73741-b550-4d0d-94f3-4b8838d55637
25+
spec:
26+
containers:
27+
- command:
28+
- kube-apiserver
29+
- '--advertise-address=192.168.49.2'
30+
- '--allow-privileged=true'
31+
- '--authorization-mode=Node,RBAC'
32+
- '--client-ca-file=/var/lib/minikube/certs/ca.crt'
33+
- >-
34+
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota
35+
- '--enable-bootstrap-token-auth=true'
36+
- '--etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt'
37+
- '--etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt'
38+
- '--etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key'
39+
- '--etcd-servers=https://127.0.0.1:2379'
40+
- >-
41+
--kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt
42+
- >-
43+
--kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key
44+
- '--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname'
45+
- >-
46+
--proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt
47+
- '--proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key'
48+
- '--requestheader-allowed-names=front-proxy-client'
49+
- >-
50+
--requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt
51+
- '--requestheader-extra-headers-prefix=X-Remote-Extra-'
52+
- '--requestheader-group-headers=X-Remote-Group'
53+
- '--requestheader-username-headers=X-Remote-User'
54+
- '--secure-port=8443'
55+
- '--service-account-issuer=https://kubernetes.default.svc.cluster.local'
56+
- '--service-account-key-file=/var/lib/minikube/certs/sa.pub'
57+
- '--service-account-signing-key-file=/var/lib/minikube/certs/sa.key'
58+
- '--service-cluster-ip-range=10.96.0.0/12'
59+
- '--tls-cert-file=/var/lib/minikube/certs/apiserver.crt'
60+
- '--tls-private-key-file=/var/lib/minikube/certs/apiserver.key'
61+
image: k8s.gcr.io/kube-apiserver:v1.24.1
62+
imagePullPolicy: IfNotPresent
63+
livenessProbe:
64+
failureThreshold: 8
65+
httpGet:
66+
host: 192.168.49.2
67+
path: /livez
68+
port: 8443
69+
scheme: HTTPS
70+
initialDelaySeconds: 10
71+
periodSeconds: 10
72+
successThreshold: 1
73+
timeoutSeconds: 15
74+
name: kube-apiserver
75+
readinessProbe:
76+
failureThreshold: 3
77+
httpGet:
78+
host: 192.168.49.2
79+
path: /readyz
80+
port: 8443
81+
scheme: HTTPS
82+
periodSeconds: 1
83+
successThreshold: 1
84+
timeoutSeconds: 15
85+
resources:
86+
requests:
87+
cpu: 250m
88+
startupProbe:
89+
failureThreshold: 24
90+
httpGet:
91+
host: 192.168.49.2
92+
path: /livez
93+
port: 8443
94+
scheme: HTTPS
95+
initialDelaySeconds: 10
96+
periodSeconds: 10
97+
successThreshold: 1
98+
timeoutSeconds: 15
99+
terminationMessagePath: /dev/termination-log
100+
terminationMessagePolicy: File
101+
volumeMounts:
102+
- mountPath: /etc/ssl/certs
103+
name: ca-certs
104+
readOnly: true
105+
- mountPath: /etc/ca-certificates
106+
name: etc-ca-certificates
107+
readOnly: true
108+
- mountPath: /var/lib/minikube/certs
109+
name: k8s-certs
110+
readOnly: true
111+
- mountPath: /usr/local/share/ca-certificates
112+
name: usr-local-share-ca-certificates
113+
readOnly: true
114+
- mountPath: /usr/share/ca-certificates
115+
name: usr-share-ca-certificates
116+
readOnly: true
117+
dnsPolicy: ClusterFirst
118+
enableServiceLinks: true
119+
hostNetwork: true
120+
nodeName: minikube
121+
preemptionPolicy: PreemptLowerPriority
122+
priority: 2000001000
123+
priorityClassName: system-node-critical
124+
restartPolicy: Always
125+
schedulerName: default-scheduler
126+
securityContext:
127+
seccompProfile:
128+
type: RuntimeDefault
129+
terminationGracePeriodSeconds: 30
130+
tolerations:
131+
- effect: NoExecute
132+
operator: Exists
133+
volumes:
134+
- hostPath:
135+
path: /etc/ssl/certs
136+
type: DirectoryOrCreate
137+
name: ca-certs
138+
- hostPath:
139+
path: /etc/ca-certificates
140+
type: DirectoryOrCreate
141+
name: etc-ca-certificates
142+
- hostPath:
143+
path: /var/lib/minikube/certs
144+
type: DirectoryOrCreate
145+
name: k8s-certs
146+
- hostPath:
147+
path: /usr/local/share/ca-certificates
148+
type: DirectoryOrCreate
149+
name: usr-local-share-ca-certificates
150+
- hostPath:
151+
path: /usr/share/ca-certificates
152+
type: DirectoryOrCreate
153+
name: usr-share-ca-certificates

‎rules/ensure-that-the-api-server-DenyServiceExternalIPs-is-set/test/passed/expected.json

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[]

0 commit comments

Comments
 (0)