sample-result.yaml

apiVersion: wgpolicyk8s.io/v1alpha2
kind: ClusterPolicyReport
metadata:
  annotations:
    app.kubernetes.io/managed-by: kube-bench-adapter
    benchmark: cis-1.24
  creationTimestamp: "2023-08-25T06:58:56Z"
  generation: 1
  name: kube-bench
  resourceVersion: "40757"
  uid: d56af434-b6eb-4d22-9da5-ce38fe778bba
results:
- category: CIS Benchmarks
  message: Ensure that the API server pod specification file permissions are set to
    600 or more restrictive (Automated)
  policy: 1.1.1-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then
      stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.1
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the
      control plane node.
      For example, chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the
      control plane node.
      For example, chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33556409
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the API server pod specification file ownership is set to root:root
    (Automated)
  policy: 1.1.2-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then
      stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.2
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33562954
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the controller manager pod specification file permissions are
    set to 600 or more restrictive (Automated)
  policy: 1.1.3-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-controller-manager.yaml;
      then stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml;
      fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.3
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33565125
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the controller manager pod specification file ownership is
    set to root:root (Automated)
  policy: 1.1.4-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-controller-manager.yaml;
      then stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.4
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33566980
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the scheduler pod specification file permissions are set to
    600 or more restrictive (Automated)
  policy: 1.1.5-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-scheduler.yaml; then
      stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.5
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33568379
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the scheduler pod specification file ownership is set to root:root
    (Automated)
  policy: 1.1.6-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-scheduler.yaml; then
      stat -c %U:%G /etc/kubernetes/manifests/kube-scheduler.yaml; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.6
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33569982
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the etcd pod specification file permissions are set to 600
    or more restrictive (Automated)
  policy: 1.1.7-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml
      -name '*etcd*' | xargs stat -c permissions=%a; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.7
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod 600 /etc/kubernetes/manifests/etcd.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod 600 /etc/kubernetes/manifests/etcd.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33571021
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the etcd pod specification file ownership is set to root:root
    (Automated)
  policy: 1.1.8-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml
      -name '*etcd*' | xargs stat -c %U:%G; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.8
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root /etc/kubernetes/manifests/etcd.yaml
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root /etc/kubernetes/manifests/etcd.yaml
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33571954
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the Container Network Interface file permissions are set to
    600 or more restrictive (Manual)
  policy: 1.1.9-Control Plane Security Configuration
  properties:
    actual_value: ""
    audit: |
      ps -ef | grep kubelet | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
      find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
    auditConfig: ""
    auditEnv: ""
    expected_result: '''permissions'' is present'
    index: 1.1.9
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 <path/to/cni/files>
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 <path/to/cni/files>
    type: ""
  result: warn
  rule: Control Plane Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 33573152
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the Container Network Interface file ownership is set to root:root
    (Manual)
  policy: 1.1.10-Control Plane Security Configuration
  properties:
    actual_value: ""
    audit: |
      ps -ef | grep kubelet | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
      find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.10
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root <path/to/cni/files>
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root <path/to/cni/files>
    type: ""
  result: warn
  rule: Control Plane Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 33596154
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the etcd data directory permissions are set to 700 or more
    restrictive (Automated)
  policy: 1.1.11-Control Plane Security Configuration
  properties:
    actual_value: permissions=700
    audit: |
      DATA_DIR=''
      for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
        if test -d "$d"; then DATA_DIR="$d"; fi
      done
      if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
      stat -c permissions=%a "$DATA_DIR"
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 700, expected 700 or more restrictive
    index: 1.1.11
    isMultiple: "false"
    reason: ""
    remediation: |
      On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
      from the command 'ps -ef | grep etcd'.
      Run the below command (based on the etcd data directory found above). For example,
      chmod 700 /var/lib/etcd
    test_info: |
      On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
      from the command 'ps -ef | grep etcd'.
      Run the below command (based on the etcd data directory found above). For example,
      chmod 700 /var/lib/etcd
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33597303
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)
  policy: 1.1.12-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: |
      DATA_DIR=''
      for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
        if test -d "$d"; then DATA_DIR="$d"; fi
      done
      if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
      stat -c %U:%G "$DATA_DIR"
    auditConfig: ""
    auditEnv: ""
    expected_result: '''etcd:etcd'' is present'
    index: 1.1.12
    isMultiple: "false"
    reason: ""
    remediation: |
      On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
      from the command 'ps -ef | grep etcd'.
      Run the below command (based on the etcd data directory found above).
      For example, chown etcd:etcd /var/lib/etcd
    test_info: |
      On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
      from the command 'ps -ef | grep etcd'.
      Run the below command (based on the etcd data directory found above).
      For example, chown etcd:etcd /var/lib/etcd
    type: ""
  result: fail
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33598498
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admin.conf file permissions are set to 600 or more restrictive
    (Automated)
  policy: 1.1.13-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a
      /etc/kubernetes/admin.conf; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.13
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 /etc/kubernetes/admin.conf
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chmod 600 /etc/kubernetes/admin.conf
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33599542
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admin.conf file ownership is set to root:root (Automated)
  policy: 1.1.14-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf;
      fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.14
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/admin.conf
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example, chown root:root /etc/kubernetes/admin.conf
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33600623
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the scheduler.conf file permissions are set to 600 or more
    restrictive (Automated)
  policy: 1.1.15-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a
      /etc/kubernetes/scheduler.conf; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.15
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod 600 /etc/kubernetes/scheduler.conf
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod 600 /etc/kubernetes/scheduler.conf
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33614768
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the scheduler.conf file ownership is set to root:root (Automated)
  policy: 1.1.16-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %U:%G
      /etc/kubernetes/scheduler.conf; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.16
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root /etc/kubernetes/scheduler.conf
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root /etc/kubernetes/scheduler.conf
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33615885
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the controller-manager.conf file permissions are set to 600
    or more restrictive (Automated)
  policy: 1.1.17-Control Plane Security Configuration
  properties:
    actual_value: permissions=600
    audit: /bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat
      -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.17
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod 600 /etc/kubernetes/controller-manager.conf
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod 600 /etc/kubernetes/controller-manager.conf
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33616999
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the controller-manager.conf file ownership is set to root:root
    (Automated)
  policy: 1.1.18-Control Plane Security Configuration
  properties:
    actual_value: root:root
    audit: /bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat
      -c %U:%G /etc/kubernetes/controller-manager.conf; fi'
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.18
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root /etc/kubernetes/controller-manager.conf
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown root:root /etc/kubernetes/controller-manager.conf
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33618688
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the Kubernetes PKI directory and file ownership is set to root:root
    (Automated)
  policy: 1.1.19-Control Plane Security Configuration
  properties:
    actual_value: |-
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
      root:root
    audit: find /etc/kubernetes/pki/ | xargs stat -c %U:%G
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 1.1.19
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown -R root:root /etc/kubernetes/pki/
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chown -R root:root /etc/kubernetes/pki/
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33619668
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the Kubernetes PKI certificate file permissions are set to
    600 or more restrictive (Manual)
  policy: 1.1.20-Control Plane Security Configuration
  properties:
    actual_value: |-
      permissions=644
      permissions=644
      permissions=644
      permissions=644
      permissions=644
      permissions=644
      permissions=644
      permissions=644
      permissions=644
      permissions=644
    audit: find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 644, expected 600 or more restrictive
    index: 1.1.20
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod -R 600 /etc/kubernetes/pki/*.crt
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod -R 600 /etc/kubernetes/pki/*.crt
    type: ""
  result: warn
  rule: Control Plane Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 33620933
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)
  policy: 1.1.21-Control Plane Security Configuration
  properties:
    actual_value: |-
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
      permissions=600
    audit: find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 1.1.21
    isMultiple: "true"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod -R 600 /etc/kubernetes/pki/*.key
    test_info: |
      Run the below command (based on the file location on your system) on the control plane node.
      For example,
      chmod -R 600 /etc/kubernetes/pki/*.key
    type: ""
  result: pass
  rule: Control Plane Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 33622737
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --anonymous-auth argument is set to false (Manual)
  policy: 1.2.1-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--anonymous-auth'' is present'
    index: 1.2.1
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --anonymous-auth=false
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --anonymous-auth=false
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33623944
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --token-auth-file parameter is not set (Automated)
  policy: 1.2.2-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--token-auth-file'' is not present'
    index: 1.2.2
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the documentation and configure alternate mechanisms for authentication. Then,
      edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and remove the --token-auth-file=<filename> parameter.
    test_info: |
      Follow the documentation and configure alternate mechanisms for authentication. Then,
      edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and remove the --token-auth-file=<filename> parameter.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33625109
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --DenyServiceExternalIPs is not set (Automated)
  policy: 1.2.3-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--enable-admission-plugins'' does not have ''DenyServiceExternalIPs''
      OR ''--enable-admission-plugins'' is not present'
    index: 1.2.3
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and remove the `DenyServiceExternalIPs`
      from enabled admission plugins.
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and remove the `DenyServiceExternalIPs`
      from enabled admission plugins.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33626091
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments
    are set as appropriate (Automated)
  policy: 1.2.4-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--kubelet-client-certificate'' is present AND ''--kubelet-client-key''
      is present'
    index: 1.2.4
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and set up the TLS connection between the
      apiserver and kubelets. Then, edit API server pod specification file
      /etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
      kubelet client certificate and key parameters as below.
      --kubelet-client-certificate=<path/to/client-certificate-file>
      --kubelet-client-key=<path/to/client-key-file>
    test_info: |
      Follow the Kubernetes documentation and set up the TLS connection between the
      apiserver and kubelets. Then, edit API server pod specification file
      /etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
      kubelet client certificate and key parameters as below.
      --kubelet-client-certificate=<path/to/client-certificate-file>
      --kubelet-client-key=<path/to/client-key-file>
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33627227
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --kubelet-certificate-authority argument is set as appropriate
    (Automated)
  policy: 1.2.5-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--kubelet-certificate-authority'' is present'
    index: 1.2.5
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and setup the TLS connection between
      the apiserver and kubelets. Then, edit the API server pod specification file
      /etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
      --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
      --kubelet-certificate-authority=<ca-string>
    test_info: |
      Follow the Kubernetes documentation and setup the TLS connection between
      the apiserver and kubelets. Then, edit the API server pod specification file
      /etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
      --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
      --kubelet-certificate-authority=<ca-string>
    type: ""
  result: fail
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33628527
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --authorization-mode argument is not set to AlwaysAllow
    (Automated)
  policy: 1.2.6-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--authorization-mode'' does not have ''AlwaysAllow'''
    index: 1.2.6
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
      One such example could be as below.
      --authorization-mode=RBAC
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
      One such example could be as below.
      --authorization-mode=RBAC
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33641044
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --authorization-mode argument includes Node (Automated)
  policy: 1.2.7-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--authorization-mode'' has ''Node'''
    index: 1.2.7
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --authorization-mode parameter to a value that includes Node.
      --authorization-mode=Node,RBAC
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --authorization-mode parameter to a value that includes Node.
      --authorization-mode=Node,RBAC
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33651699
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --authorization-mode argument includes RBAC (Automated)
  policy: 1.2.8-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--authorization-mode'' has ''RBAC'''
    index: 1.2.8
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
      for example `--authorization-mode=Node,RBAC`.
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
      for example `--authorization-mode=Node,RBAC`.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33652711
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin EventRateLimit is set (Manual)
  policy: 1.2.9-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--enable-admission-plugins'' has ''EventRateLimit'''
    index: 1.2.9
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and set the desired limits in a configuration file.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      and set the below parameters.
      --enable-admission-plugins=...,EventRateLimit,...
      --admission-control-config-file=<path/to/configuration/file>
    test_info: |
      Follow the Kubernetes documentation and set the desired limits in a configuration file.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      and set the below parameters.
      --enable-admission-plugins=...,EventRateLimit,...
      --admission-control-config-file=<path/to/configuration/file>
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33654046
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin AlwaysAdmit is not set (Automated)
  policy: 1.2.10-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--enable-admission-plugins'' does not have ''AlwaysAdmit''
      OR ''--enable-admission-plugins'' is not present'
    index: 1.2.10
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
      value that does not include AlwaysAdmit.
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
      value that does not include AlwaysAdmit.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33655239
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin AlwaysPullImages is set (Manual)
  policy: 1.2.11-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--enable-admission-plugins'' has ''AlwaysPullImages'''
    index: 1.2.11
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --enable-admission-plugins parameter to include
      AlwaysPullImages.
      --enable-admission-plugins=...,AlwaysPullImages,...
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --enable-admission-plugins parameter to include
      AlwaysPullImages.
      --enable-admission-plugins=...,AlwaysPullImages,...
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33656207
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin SecurityContextDeny is set if
    PodSecurityPolicy is not used (Manual)
  policy: 1.2.12-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--enable-admission-plugins'' has ''SecurityContextDeny'' OR
      ''--enable-admission-plugins'' has ''PodSecurityPolicy'''
    index: 1.2.12
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --enable-admission-plugins parameter to include
      SecurityContextDeny, unless PodSecurityPolicy is already in place.
      --enable-admission-plugins=...,SecurityContextDeny,...
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --enable-admission-plugins parameter to include
      SecurityContextDeny, unless PodSecurityPolicy is already in place.
      --enable-admission-plugins=...,SecurityContextDeny,...
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33657288
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin ServiceAccount is set (Automated)
  policy: 1.2.13-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--disable-admission-plugins'' is present OR ''--disable-admission-plugins''
      is not present'
    index: 1.2.13
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the documentation and create ServiceAccount objects as per your environment.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
      value that does not include ServiceAccount.
    test_info: |
      Follow the documentation and create ServiceAccount objects as per your environment.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
      value that does not include ServiceAccount.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33661217
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin NamespaceLifecycle is set (Automated)
  policy: 1.2.14-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--disable-admission-plugins'' is present OR ''--disable-admission-plugins''
      is not present'
    index: 1.2.14
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --disable-admission-plugins parameter to
      ensure it does not include NamespaceLifecycle.
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --disable-admission-plugins parameter to
      ensure it does not include NamespaceLifecycle.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33662448
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the admission control plugin NodeRestriction is set (Automated)
  policy: 1.2.15-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--enable-admission-plugins'' has ''NodeRestriction'''
    index: 1.2.15
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --enable-admission-plugins parameter to a
      value that includes NodeRestriction.
      --enable-admission-plugins=...,NodeRestriction,...
    test_info: |
      Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --enable-admission-plugins parameter to a
      value that includes NodeRestriction.
      --enable-admission-plugins=...,NodeRestriction,...
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33663699
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --secure-port argument is not set to 0 (Automated)
  policy: 1.2.16-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--secure-port'' is greater than 0 OR ''--secure-port'' is
      not present'
    index: 1.2.16
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and either remove the --secure-port parameter or
      set it to a different (non-zero) desired port.
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and either remove the --secure-port parameter or
      set it to a different (non-zero) desired port.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33664842
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --profiling argument is set to false (Automated)
  policy: 1.2.17-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--profiling'' is present'
    index: 1.2.17
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --profiling=false
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --profiling=false
    type: ""
  result: fail
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33685193
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --audit-log-path argument is set (Automated)
  policy: 1.2.18-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--audit-log-path'' is present'
    index: 1.2.18
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-path parameter to a suitable path and
      file where you would like audit logs to be written, for example,
      --audit-log-path=/var/log/apiserver/audit.log
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-path parameter to a suitable path and
      file where you would like audit logs to be written, for example,
      --audit-log-path=/var/log/apiserver/audit.log
    type: ""
  result: fail
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33686526
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
    (Automated)
  policy: 1.2.19-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--audit-log-maxage'' is present'
    index: 1.2.19
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-maxage parameter to 30
      or as an appropriate number of days, for example,
      --audit-log-maxage=30
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-maxage parameter to 30
      or as an appropriate number of days, for example,
      --audit-log-maxage=30
    type: ""
  result: fail
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33687628
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
    (Automated)
  policy: 1.2.20-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--audit-log-maxbackup'' is present'
    index: 1.2.20
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
      value. For example,
      --audit-log-maxbackup=10
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
      value. For example,
      --audit-log-maxbackup=10
    type: ""
  result: fail
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33690022
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
    (Automated)
  policy: 1.2.21-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--audit-log-maxsize'' is present'
    index: 1.2.21
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
      For example, to set it as 100 MB, --audit-log-maxsize=100
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
      For example, to set it as 100 MB, --audit-log-maxsize=100
    type: ""
  result: fail
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33691804
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --request-timeout argument is set as appropriate (Manual)
  policy: 1.2.22-Control Plane Security Configuration
  properties:
    actual_value: ""
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 1.2.22
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      and set the below parameter as appropriate and if needed.
      For example, --request-timeout=300s
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      and set the below parameter as appropriate and if needed.
      For example, --request-timeout=300s
    type: manual
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33693031
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --service-account-lookup argument is set to true (Automated)
  policy: 1.2.23-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--service-account-lookup'' is not present OR ''--service-account-lookup''
      is present'
    index: 1.2.23
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --service-account-lookup=true
      Alternatively, you can delete the --service-account-lookup parameter from this file so
      that the default takes effect.
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --service-account-lookup=true
      Alternatively, you can delete the --service-account-lookup parameter from this file so
      that the default takes effect.
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33704325
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --service-account-key-file argument is set as appropriate
    (Automated)
  policy: 1.2.24-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--service-account-key-file'' is present'
    index: 1.2.24
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --service-account-key-file parameter
      to the public key file for service accounts. For example,
      --service-account-key-file=<filename>
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --service-account-key-file parameter
      to the public key file for service accounts. For example,
      --service-account-key-file=<filename>
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33706555
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as
    appropriate (Automated)
  policy: 1.2.25-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--etcd-certfile'' is present AND ''--etcd-keyfile'' is present'
    index: 1.2.25
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the etcd certificate and key file parameters.
      --etcd-certfile=<path/to/client-certificate-file>
      --etcd-keyfile=<path/to/client-key-file>
    test_info: |
      Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the etcd certificate and key file parameters.
      --etcd-certfile=<path/to/client-certificate-file>
      --etcd-keyfile=<path/to/client-key-file>
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33707507
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --tls-cert-file and --tls-private-key-file arguments are
    set as appropriate (Automated)
  policy: 1.2.26-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--tls-cert-file'' is present AND ''--tls-private-key-file''
      is present'
    index: 1.2.26
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the TLS certificate and private key file parameters.
      --tls-cert-file=<path/to/tls-certificate-file>
      --tls-private-key-file=<path/to/tls-key-file>
    test_info: |
      Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the TLS certificate and private key file parameters.
      --tls-cert-file=<path/to/tls-certificate-file>
      --tls-private-key-file=<path/to/tls-key-file>
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33710532
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --client-ca-file argument is set as appropriate (Automated)
  policy: 1.2.27-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--client-ca-file'' is present'
    index: 1.2.27
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the client certificate authority file.
      --client-ca-file=<path/to/client-ca-file>
    test_info: |
      Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the client certificate authority file.
      --client-ca-file=<path/to/client-ca-file>
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33712589
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --etcd-cafile argument is set as appropriate (Automated)
  policy: 1.2.28-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--etcd-cafile'' is present'
    index: 1.2.28
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the etcd certificate authority file parameter.
      --etcd-cafile=<path/to/ca-file>
    test_info: |
      Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the etcd certificate authority file parameter.
      --etcd-cafile=<path/to/ca-file>
    type: ""
  result: pass
  rule: API Server
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 33714466
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --encryption-provider-config argument is set as appropriate
    (Manual)
  policy: 1.2.29-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--encryption-provider-config'' is present'
    index: 1.2.29
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and configure a EncryptionConfig file.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --encryption-provider-config parameter to the path of that file.
      For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
    test_info: |
      Follow the Kubernetes documentation and configure a EncryptionConfig file.
      Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the --encryption-provider-config parameter to the path of that file.
      For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33716033
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that encryption providers are appropriately configured (Manual)
  policy: 1.2.30-Control Plane Security Configuration
  properties:
    actual_value: ""
    audit: |
      ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
      if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
    auditConfig: ""
    auditEnv: ""
    expected_result: '''provider'' is present'
    index: 1.2.30
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the Kubernetes documentation and configure a EncryptionConfig file.
      In this file, choose aescbc, kms or secretbox as the encryption provider.
    test_info: |
      Follow the Kubernetes documentation and configure a EncryptionConfig file.
      In this file, choose aescbc, kms or secretbox as the encryption provider.
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 33717341
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the API Server only makes use of Strong Cryptographic Ciphers
    (Manual)
  policy: 1.2.31-Control Plane Security Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--tls-cipher-suites'' is present'
    index: 1.2.31
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
      TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
    test_info: |
      Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
      on the control plane node and set the below parameter.
      --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
      TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
    type: ""
  result: warn
  rule: API Server
  source: kube-bench-adapter
  timestamp:
    nanos: 34110572
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --terminated-pod-gc-threshold argument is set as appropriate
    (Manual)
  policy: 1.3.1-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--terminated-pod-gc-threshold'' is present'
    index: 1.3.1
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
      for example, --terminated-pod-gc-threshold=10
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
      for example, --terminated-pod-gc-threshold=10
    type: ""
  result: warn
  rule: Controller Manager
  source: kube-bench-adapter
  timestamp:
    nanos: 34113428
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --profiling argument is set to false (Automated)
  policy: 1.3.2-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--profiling'' is present'
    index: 1.3.2
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the below parameter.
      --profiling=false
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the below parameter.
      --profiling=false
    type: ""
  result: fail
  rule: Controller Manager
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34116470
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --use-service-account-credentials argument is set to true
    (Automated)
  policy: 1.3.3-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--use-service-account-credentials'' is not equal to ''false'''
    index: 1.3.3
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node to set the below parameter.
      --use-service-account-credentials=true
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node to set the below parameter.
      --use-service-account-credentials=true
    type: ""
  result: pass
  rule: Controller Manager
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34125804
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --service-account-private-key-file argument is set as appropriate
    (Automated)
  policy: 1.3.4-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--service-account-private-key-file'' is present'
    index: 1.3.4
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --service-account-private-key-file parameter
      to the private key file for service accounts.
      --service-account-private-key-file=<filename>
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --service-account-private-key-file parameter
      to the private key file for service accounts.
      --service-account-private-key-file=<filename>
    type: ""
  result: pass
  rule: Controller Manager
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34127315
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --root-ca-file argument is set as appropriate (Automated)
  policy: 1.3.5-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--root-ca-file'' is present'
    index: 1.3.5
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
      --root-ca-file=<path/to/file>
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
      --root-ca-file=<path/to/file>
    type: ""
  result: pass
  rule: Controller Manager
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34136000
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the RotateKubeletServerCertificate argument is set to true
    (Automated)
  policy: 1.3.6-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--feature-gates'' is present OR ''--feature-gates'' is not
      present'
    index: 1.3.6
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
      --feature-gates=RotateKubeletServerCertificate=true
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
      --feature-gates=RotateKubeletServerCertificate=true
    type: ""
  result: pass
  rule: Controller Manager
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34148045
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)
  policy: 1.3.7-Control Plane Security Configuration
  properties:
    actual_value: root       27181     351  2 03:58 ?        00:05:07 kube-controller-manager
      --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
      --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf --bind-address=127.0.0.1
      --client-ca-file=/etc/kubernetes/pki/ca.crt --cluster-cidr=10.244.0.0/16 --cluster-name=kind
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
      --controllers=*,bootstrapsigner,tokencleaner --enable-hostpath-provisioner=true
      --kubeconfig=/etc/kubernetes/controller-manager.conf --leader-elect=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key
      --service-cluster-ip-range=10.96.0.0/16 --use-service-account-credentials=true
    audit: /bin/ps -ef | grep kube-controller-manager | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--bind-address'' is equal to ''127.0.0.1'' OR ''--bind-address''
      is not present'
    index: 1.3.7
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and ensure the correct value for the --bind-address parameter
    test_info: |
      Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
      on the control plane node and ensure the correct value for the --bind-address parameter
    type: ""
  result: pass
  rule: Controller Manager
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34161120
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --profiling argument is set to false (Automated)
  policy: 1.4.1-Control Plane Security Configuration
  properties:
    actual_value: root       27164     395  0 03:58 ?        00:00:57 kube-scheduler
      --authentication-kubeconfig=/etc/kubernetes/scheduler.conf --authorization-kubeconfig=/etc/kubernetes/scheduler.conf
      --bind-address=127.0.0.1 --kubeconfig=/etc/kubernetes/scheduler.conf --leader-elect=true
    audit: /bin/ps -ef | grep kube-scheduler | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--profiling'' is present'
    index: 1.4.1
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
      on the control plane node and set the below parameter.
      --profiling=false
    test_info: |
      Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
      on the control plane node and set the below parameter.
      --profiling=false
    type: ""
  result: fail
  rule: Scheduler
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34169438
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)
  policy: 1.4.2-Control Plane Security Configuration
  properties:
    actual_value: root       27164     395  0 03:58 ?        00:00:57 kube-scheduler
      --authentication-kubeconfig=/etc/kubernetes/scheduler.conf --authorization-kubeconfig=/etc/kubernetes/scheduler.conf
      --bind-address=127.0.0.1 --kubeconfig=/etc/kubernetes/scheduler.conf --leader-elect=true
    audit: /bin/ps -ef | grep kube-scheduler | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--bind-address'' is equal to ''127.0.0.1'' OR ''--bind-address''
      is not present'
    index: 1.4.2
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
      on the control plane node and ensure the correct value for the --bind-address parameter
    test_info: |
      Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
      on the control plane node and ensure the correct value for the --bind-address parameter
    type: ""
  result: pass
  rule: Scheduler
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34171056
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --cert-file and --key-file arguments are set as appropriate
    (Automated)
  policy: 2.1-Etcd Node Configuration
  properties:
    actual_value: |-
      root         589     331  5 Aug24 ?        00:40:25 kube-apiserver --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16 --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
      root         664     352  1 Aug24 ?        00:07:21 etcd --advertise-client-urls=https://172.18.0.2:2379 --cert-file=/etc/kubernetes/pki/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/etcd --experimental-initial-corrupt-check=true --initial-advertise-peer-urls=https://172.18.0.2:2380 --initial-cluster=kind-control-plane=https://172.18.0.2:2380 --key-file=/etc/kubernetes/pki/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://172.18.0.2:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://172.18.0.2:2380 --name=kind-control-plane --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/etc/kubernetes/pki/etcd/peer.key --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      1000      136322  136271  1 06:58 ?        00:00:00 ./policyreport -name kube-bench -category CIS Benchmarks -namespace kube-bench -kube-bench-image aquasec/kube-bench:v0.6.17 -kubeconfig $HOME/.kube/config -kube-bench-targets master,node,etcd,policies -kube-bench-benchmark cis-1.24
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''--cert-file'' is present AND ''--key-file'' is present'
    index: "2.1"
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the etcd service documentation and configure TLS encryption.
      Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
      on the master node and set the below parameters.
      --cert-file=</path/to/ca-file>
      --key-file=</path/to/key-file>
    test_info: |
      Follow the etcd service documentation and configure TLS encryption.
      Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
      on the master node and set the below parameters.
      --cert-file=</path/to/ca-file>
      --key-file=</path/to/key-file>
    type: ""
  result: pass
  rule: Etcd Node Configuration
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34172725
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --client-cert-auth argument is set to true (Automated)
  policy: 2.2-Etcd Node Configuration
  properties:
    actual_value: |-
      root         589     331  5 Aug24 ?        00:40:25 kube-apiserver --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16 --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
      root         664     352  1 Aug24 ?        00:07:21 etcd --advertise-client-urls=https://172.18.0.2:2379 --cert-file=/etc/kubernetes/pki/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/etcd --experimental-initial-corrupt-check=true --initial-advertise-peer-urls=https://172.18.0.2:2380 --initial-cluster=kind-control-plane=https://172.18.0.2:2380 --key-file=/etc/kubernetes/pki/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://172.18.0.2:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://172.18.0.2:2380 --name=kind-control-plane --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/etc/kubernetes/pki/etcd/peer.key --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      1000      136322  136271  1 06:58 ?        00:00:00 ./policyreport -name kube-bench -category CIS Benchmarks -namespace kube-bench -kube-bench-image aquasec/kube-bench:v0.6.17 -kubeconfig $HOME/.kube/config -kube-bench-targets master,node,etcd,policies -kube-bench-benchmark cis-1.24
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''--client-cert-auth'' is equal to ''true'''
    index: "2.2"
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and set the below parameter.
      --client-cert-auth="true"
    test_info: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and set the below parameter.
      --client-cert-auth="true"
    type: ""
  result: pass
  rule: Etcd Node Configuration
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34174200
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --auto-tls argument is not set to true (Automated)
  policy: 2.3-Etcd Node Configuration
  properties:
    actual_value: |-
      PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
      HOSTNAME=kind-control-plane
      SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
      HOME=/root
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''ETCD_AUTO_TLS'' is not present OR ''ETCD_AUTO_TLS'' is present'
    index: "2.3"
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and either remove the --auto-tls parameter or set it to false.
        --auto-tls=false
    test_info: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and either remove the --auto-tls parameter or set it to false.
        --auto-tls=false
    type: ""
  result: pass
  rule: Etcd Node Configuration
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 34175521
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --peer-cert-file and --peer-key-file arguments are set
    as appropriate (Automated)
  policy: 2.4-Etcd Node Configuration
  properties:
    actual_value: |-
      root         589     331  5 Aug24 ?        00:40:25 kube-apiserver --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16 --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
      root         664     352  1 Aug24 ?        00:07:21 etcd --advertise-client-urls=https://172.18.0.2:2379 --cert-file=/etc/kubernetes/pki/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/etcd --experimental-initial-corrupt-check=true --initial-advertise-peer-urls=https://172.18.0.2:2380 --initial-cluster=kind-control-plane=https://172.18.0.2:2380 --key-file=/etc/kubernetes/pki/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://172.18.0.2:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://172.18.0.2:2380 --name=kind-control-plane --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/etc/kubernetes/pki/etcd/peer.key --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      1000      136322  136271  1 06:58 ?        00:00:00 ./policyreport -name kube-bench -category CIS Benchmarks -namespace kube-bench -kube-bench-image aquasec/kube-bench:v0.6.17 -kubeconfig $HOME/.kube/config -kube-bench-targets master,node,etcd,policies -kube-bench-benchmark cis-1.24
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''--peer-cert-file'' is present AND ''--peer-key-file'' is present'
    index: "2.4"
    isMultiple: "false"
    reason: ""
    remediation: |
      Follow the etcd service documentation and configure peer TLS encryption as appropriate
      for your etcd cluster.
      Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
      master node and set the below parameters.
      --peer-client-file=</path/to/peer-cert-file>
      --peer-key-file=</path/to/peer-key-file>
    test_info: |
      Follow the etcd service documentation and configure peer TLS encryption as appropriate
      for your etcd cluster.
      Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
      master node and set the below parameters.
      --peer-client-file=</path/to/peer-cert-file>
      --peer-key-file=</path/to/peer-key-file>
    type: ""
  result: pass
  rule: Etcd Node Configuration
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45317078
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --peer-client-cert-auth argument is set to true (Automated)
  policy: 2.5-Etcd Node Configuration
  properties:
    actual_value: |-
      root         589     331  5 Aug24 ?        00:40:25 kube-apiserver --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16 --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
      root         664     352  1 Aug24 ?        00:07:21 etcd --advertise-client-urls=https://172.18.0.2:2379 --cert-file=/etc/kubernetes/pki/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/etcd --experimental-initial-corrupt-check=true --initial-advertise-peer-urls=https://172.18.0.2:2380 --initial-cluster=kind-control-plane=https://172.18.0.2:2380 --key-file=/etc/kubernetes/pki/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://172.18.0.2:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://172.18.0.2:2380 --name=kind-control-plane --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/etc/kubernetes/pki/etcd/peer.key --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      1000      136322  136271  1 06:58 ?        00:00:00 ./policyreport -name kube-bench -category CIS Benchmarks -namespace kube-bench -kube-bench-image aquasec/kube-bench:v0.6.17 -kubeconfig $HOME/.kube/config -kube-bench-targets master,node,etcd,policies -kube-bench-benchmark cis-1.24
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''--peer-client-cert-auth'' is equal to ''true'''
    index: "2.5"
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and set the below parameter.
      --peer-client-cert-auth=true
    test_info: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and set the below parameter.
      --peer-client-cert-auth=true
    type: ""
  result: pass
  rule: Etcd Node Configuration
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45329893
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --peer-auto-tls argument is not set to true (Automated)
  policy: 2.6-Etcd Node Configuration
  properties:
    actual_value: |-
      PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
      HOSTNAME=kind-control-plane
      SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
      HOME=/root
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''ETCD_PEER_AUTO_TLS'' is not present OR ''ETCD_PEER_AUTO_TLS''
      is present'
    index: "2.6"
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and either remove the --peer-auto-tls parameter or set it to false.
      --peer-auto-tls=false
    test_info: |
      Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
      node and either remove the --peer-auto-tls parameter or set it to false.
      --peer-auto-tls=false
    type: ""
  result: pass
  rule: Etcd Node Configuration
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45331688
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that a unique Certificate Authority is used for etcd (Manual)
  policy: 2.7-Etcd Node Configuration
  properties:
    actual_value: |-
      root         589     331  5 Aug24 ?        00:40:25 kube-apiserver --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16 --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
      root         664     352  1 Aug24 ?        00:07:21 etcd --advertise-client-urls=https://172.18.0.2:2379 --cert-file=/etc/kubernetes/pki/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/etcd --experimental-initial-corrupt-check=true --initial-advertise-peer-urls=https://172.18.0.2:2380 --initial-cluster=kind-control-plane=https://172.18.0.2:2380 --key-file=/etc/kubernetes/pki/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://172.18.0.2:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://172.18.0.2:2380 --name=kind-control-plane --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/etc/kubernetes/pki/etcd/peer.key --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      1000      136322  136271  1 06:58 ?        00:00:00 ./policyreport -name kube-bench -category CIS Benchmarks -namespace kube-bench -kube-bench-image aquasec/kube-bench:v0.6.17 -kubeconfig $HOME/.kube/config -kube-bench-targets master,node,etcd,policies -kube-bench-benchmark cis-1.24
    audit: /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
    auditConfig: ""
    auditEnv: cat "/proc/$(/bin/ps -C etcd -o pid= | tr -d ' ')/environ" | tr '\0'
      '\n'
    expected_result: '''--trusted-ca-file'' is present'
    index: "2.7"
    isMultiple: "false"
    reason: ""
    remediation: |
      [Manual test]
      Follow the etcd documentation and create a dedicated certificate authority setup for the
      etcd service.
      Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
      master node and set the below parameter.
      --trusted-ca-file=</path/to/ca-file>
    test_info: |
      [Manual test]
      Follow the etcd documentation and create a dedicated certificate authority setup for the
      etcd service.
      Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
      master node and set the below parameter.
      --trusted-ca-file=</path/to/ca-file>
    type: ""
  result: pass
  rule: Etcd Node Configuration
  source: kube-bench-adapter
  timestamp:
    nanos: 45333481
    seconds: 56
- category: CIS Benchmarks
  message: Client certificate authentication should not be used for users (Manual)
  policy: 3.1.1-Control Plane Configuration
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 3.1.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
      implemented in place of client certificates.
    test_info: |
      Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
      implemented in place of client certificates.
    type: manual
  result: warn
  rule: Authentication and Authorization
  source: kube-bench-adapter
  timestamp:
    nanos: 45336068
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that a minimal audit policy is created (Manual)
  policy: 3.2.1-Control Plane Configuration
  properties:
    actual_value: root         589     331  5 Aug24 ?        00:40:25 kube-apiserver
      --advertise-address=172.18.0.2 --allow-privileged=true --authorization-mode=Node,RBAC
      --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction
      --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --etcd-servers=https://127.0.0.1:2379 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config= --secure-port=6443
      --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/etc/kubernetes/pki/sa.pub
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-cluster-ip-range=10.96.0.0/16
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    audit: /bin/ps -ef | grep kube-apiserver | grep -v grep
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--audit-policy-file'' is present'
    index: 3.2.1
    isMultiple: "false"
    reason: ""
    remediation: |
      Create an audit policy file for your cluster.
    test_info: |
      Create an audit policy file for your cluster.
    type: ""
  result: warn
  rule: Logging
  source: kube-bench-adapter
  timestamp:
    nanos: 45346672
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the audit policy covers key security concerns (Manual)
  policy: 3.2.2-Control Plane Configuration
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 3.2.2
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Review the audit policy provided for the cluster and ensure that it covers
      at least the following areas,
      - Access to Secrets managed by the cluster. Care should be taken to only
        log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
        order to avoid risk of logging sensitive data.
      - Modification of Pod and Deployment objects.
      - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
      For most requests, minimally logging at the Metadata level is recommended
      (the most basic level of logging).
    test_info: |
      Review the audit policy provided for the cluster and ensure that it covers
      at least the following areas,
      - Access to Secrets managed by the cluster. Care should be taken to only
        log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
        order to avoid risk of logging sensitive data.
      - Modification of Pod and Deployment objects.
      - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
      For most requests, minimally logging at the Metadata level is recommended
      (the most basic level of logging).
    type: manual
  result: warn
  rule: Logging
  source: kube-bench-adapter
  timestamp:
    nanos: 45347922
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the kubelet service file permissions are set to 600 or more
    restrictive (Automated)
  policy: 4.1.1-Worker Node Security Configuration
  properties:
    actual_value: permissions=644
    audit: '/bin/sh -c ''if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf;
      then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf;
      fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 644, expected 600 or more restrictive
    index: 4.1.1
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    test_info: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    type: ""
  result: fail
  rule: Worker Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45349034
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the kubelet service file ownership is set to root:root (Automated)
  policy: 4.1.2-Worker Node Security Configuration
  properties:
    actual_value: root:root
    audit: '/bin/sh -c ''if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf;
      then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 4.1.2
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    test_info: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45375017
    seconds: 56
- category: CIS Benchmarks
  message: If proxy kubeconfig file exists ensure permissions are set to 600 or more
    restrictive (Manual)
  policy: 4.1.3-Worker Node Security Configuration
  properties:
    actual_value: ""
    audit: '/bin/sh -c ''if test -e /etc/kubernetes/proxy.conf; then stat -c permissions=%a
      /etc/kubernetes/proxy.conf; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: '''permissions'' is present OR ''/etc/kubernetes/proxy.conf''
      is not present'
    index: 4.1.3
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chmod 600 /etc/kubernetes/proxy.conf
    test_info: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chmod 600 /etc/kubernetes/proxy.conf
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 45376422
    seconds: 56
- category: CIS Benchmarks
  message: If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)
  policy: 4.1.4-Worker Node Security Configuration
  properties:
    actual_value: ""
    audit: '/bin/sh -c ''if test -e /etc/kubernetes/proxy.conf; then stat -c %U:%G
      /etc/kubernetes/proxy.conf; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present OR ''/etc/kubernetes/proxy.conf'' is
      not present'
    index: 4.1.4
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example, chown root:root /etc/kubernetes/proxy.conf
    test_info: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example, chown root:root /etc/kubernetes/proxy.conf
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 45377492
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --kubeconfig kubelet.conf file permissions are set to 600
    or more restrictive (Automated)
  policy: 4.1.5-Worker Node Security Configuration
  properties:
    actual_value: permissions=600
    audit: '/bin/sh -c ''if test -e /etc/kubernetes/kubelet.conf; then stat -c permissions=%a
      /etc/kubernetes/kubelet.conf; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 600, expected 600 or more restrictive
    index: 4.1.5
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chmod 600 /etc/kubernetes/kubelet.conf
    test_info: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chmod 600 /etc/kubernetes/kubelet.conf
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45518193
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root
    (Automated)
  policy: 4.1.6-Worker Node Security Configuration
  properties:
    actual_value: root:root
    audit: '/bin/sh -c ''if test -e /etc/kubernetes/kubelet.conf; then stat -c %U:%G
      /etc/kubernetes/kubelet.conf; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 4.1.6
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chown root:root /etc/kubernetes/kubelet.conf
    test_info: |
      Run the below command (based on the file location on your system) on the each worker node.
      For example,
      chown root:root /etc/kubernetes/kubelet.conf
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45520206
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the certificate authorities file permissions are set to 600
    or more restrictive (Manual)
  policy: 4.1.7-Worker Node Security Configuration
  properties:
    actual_value: permissions=644
    audit: |
      CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
      if test -z $CAFILE; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
      if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 644, expected 600 or more restrictive
    index: 4.1.7
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the following command to modify the file permissions of the
      --client-ca-file chmod 600 <filename>
    test_info: |
      Run the following command to modify the file permissions of the
      --client-ca-file chmod 600 <filename>
    type: ""
  result: warn
  rule: Worker Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 45524357
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the client certificate authorities file ownership is set to
    root:root (Manual)
  policy: 4.1.8-Worker Node Security Configuration
  properties:
    actual_value: root:root
    audit: |
      CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
      if test -z $CAFILE; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
      if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is equal to ''root:root'''
    index: 4.1.8
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the following command to modify the ownership of the --client-ca-file.
      chown root:root <filename>
    test_info: |
      Run the following command to modify the ownership of the --client-ca-file.
      chown root:root <filename>
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 45525516
    seconds: 56
- category: CIS Benchmarks
  message: If the kubelet config.yaml configuration file is being used validate permissions
    set to 600 or more restrictive (Manual)
  policy: 4.1.9-Worker Node Security Configuration
  properties:
    actual_value: permissions=644
    audit: '/bin/sh -c ''if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a
      /var/lib/kubelet/config.yaml; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: permissions has permissions 644, expected 600 or more restrictive
    index: 4.1.9
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the following command (using the config file location identified in the Audit step)
      chmod 600 /var/lib/kubelet/config.yaml
    test_info: |
      Run the following command (using the config file location identified in the Audit step)
      chmod 600 /var/lib/kubelet/config.yaml
    type: ""
  result: warn
  rule: Worker Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 45529026
    seconds: 56
- category: CIS Benchmarks
  message: If the kubelet config.yaml configuration file is being used validate file
    ownership is set to root:root (Manual)
  policy: 4.1.10-Worker Node Security Configuration
  properties:
    actual_value: root:root
    audit: '/bin/sh -c ''if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G
      /var/lib/kubelet/config.yaml; fi'' '
    auditConfig: ""
    auditEnv: ""
    expected_result: '''root:root'' is present'
    index: 4.1.10
    isMultiple: "false"
    reason: ""
    remediation: |
      Run the following command (using the config file location identified in the Audit step)
      chown root:root /var/lib/kubelet/config.yaml
    test_info: |
      Run the following command (using the config file location identified in the Audit step)
      chown root:root /var/lib/kubelet/config.yaml
    type: ""
  result: pass
  rule: Worker Node Configuration Files
  source: kube-bench-adapter
  timestamp:
    nanos: 45529993
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --anonymous-auth argument is set to false (Automated)
  policy: 4.2.1-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.authentication.anonymous.enabled}'' is equal to ''false'''
    index: 4.2.1
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
      `false`.
      If using executable arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      `--anonymous-auth=false`
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
      `false`.
      If using executable arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      `--anonymous-auth=false`
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45530889
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --authorization-mode argument is not set to AlwaysAllow
    (Automated)
  policy: 4.2.2-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.authorization.mode}'' does not have ''AlwaysAllow'''
    index: 4.2.2
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
      using executable arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --authorization-mode=Webhook
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
      using executable arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --authorization-mode=Webhook
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45531764
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --client-ca-file argument is set as appropriate (Automated)
  policy: 4.2.3-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.authentication.x509.clientCAFile}'' is present'
    index: 4.2.3
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
      the location of the client CA file.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --client-ca-file=<path/to/client-ca-file>
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
      the location of the client CA file.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --client-ca-file=<path/to/client-ca-file>
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45532526
    seconds: 56
- category: CIS Benchmarks
  message: Verify that the --read-only-port argument is set to 0 (Manual)
  policy: 4.2.4-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.readOnlyPort}'' is present OR ''{.readOnlyPort}'' is not
      present'
    index: 4.2.4
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --read-only-port=0
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --read-only-port=0
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45533237
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --streaming-connection-idle-timeout argument is not set
    to 0 (Manual)
  policy: 4.2.5-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.streamingConnectionIdleTimeout}'' is not equal to ''0''
      OR ''{.streamingConnectionIdleTimeout}'' is not present'
    index: 4.2.5
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
      value other than 0.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --streaming-connection-idle-timeout=5m
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
      value other than 0.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --streaming-connection-idle-timeout=5m
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45534109
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --protect-kernel-defaults argument is set to true (Automated)
  policy: 4.2.6-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.protectKernelDefaults}'' is present'
    index: 4.2.6
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --protect-kernel-defaults=true
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --protect-kernel-defaults=true
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: fail
  rule: Kubelet
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45536615
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --make-iptables-util-chains argument is set to true (Automated)
  policy: 4.2.7-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.makeIPTablesUtilChains}'' is present OR ''{.makeIPTablesUtilChains}''
      is not present'
    index: 4.2.7
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      remove the --make-iptables-util-chains argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      remove the --make-iptables-util-chains argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45541221
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --hostname-override argument is not set (Manual)
  policy: 4.2.8-Worker Node Security Configuration
  properties:
    actual_value: |-
      UID          PID    PPID  C STIME TTY          TIME CMD
      root         727       1  1 Aug24 ?        00:07:49 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --container-runtime=remote --container-runtime-endpoint=unix:///run/containerd/containerd.sock --node-ip=172.18.0.2 --node-labels= --pod-infra-container-image=k8s.gcr.io/pause:3.7 --provider-id=kind://docker/kind/kind-control-plane --fail-swap-on=false --cgroup-root=/kubelet
    audit: '/bin/ps -fC kubelet '
    auditConfig: ""
    auditEnv: ""
    expected_result: '''--hostname-override'' is not present'
    index: 4.2.8
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
      on each worker node and remove the --hostname-override argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
      on each worker node and remove the --hostname-override argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45542312
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the eventRecordQPS argument is set to a level which ensures
    appropriate event capture (Manual)
  policy: 4.2.9-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.eventRecordQPS}'' is present OR ''{.eventRecordQPS}'' is
      not present'
    index: 4.2.9
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45543302
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --tls-cert-file and --tls-private-key-file arguments are
    set as appropriate (Manual)
  policy: 4.2.10-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.tlsCertFile}'' is present AND ''{.tlsPrivateKeyFile}'' is
      present'
    index: 4.2.10
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
      of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
      to the location of the corresponding private key file.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
      --tls-cert-file=<path/to/tls-certificate-file>
      --tls-private-key-file=<path/to/tls-key-file>
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
      of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
      to the location of the corresponding private key file.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
      --tls-cert-file=<path/to/tls-certificate-file>
      --tls-private-key-file=<path/to/tls-key-file>
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: warn
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45544003
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the --rotate-certificates argument is not set to false (Automated)
  policy: 4.2.11-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.rotateCertificates}'' is equal to ''true'' OR ''{.rotateCertificates}''
      is not present'
    index: 4.2.11
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
      remove it altogether to use the default value.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
      variable.
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
      remove it altogether to use the default value.
      If using command line arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
      variable.
      Based on your system, restart the kubelet service. For example,
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  scored: true
  source: kube-bench-adapter
  timestamp:
    nanos: 45544691
    seconds: 56
- category: CIS Benchmarks
  message: Verify that the RotateKubeletServerCertificate argument is set to true
    (Manual)
  policy: 4.2.12-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{.featureGates.RotateKubeletServerCertificate}'' is present
      OR ''{.featureGates.RotateKubeletServerCertificate}'' is not present'
    index: 4.2.12
    isMultiple: "false"
    reason: ""
    remediation: |
      Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
      on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
      --feature-gates=RotateKubeletServerCertificate=true
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
      on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
      --feature-gates=RotateKubeletServerCertificate=true
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: pass
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45545852
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
    (Manual)
  policy: 4.2.13-Worker Node Security Configuration
  properties:
    actual_value: |-
      apiVersion: kubelet.config.k8s.io/v1beta1
      authentication:
        anonymous:
          enabled: false
        webhook:
          cacheTTL: 0s
          enabled: true
        x509:
          clientCAFile: /etc/kubernetes/pki/ca.crt
      authorization:
        mode: Webhook
        webhook:
          cacheAuthorizedTTL: 0s
          cacheUnauthorizedTTL: 0s
      cgroupDriver: systemd
      cgroupRoot: /kubelet
      clusterDNS:
      - 10.96.0.10
      clusterDomain: cluster.local
      cpuManagerReconcilePeriod: 0s
      evictionHard:
        imagefs.available: 0%
        nodefs.available: 0%
        nodefs.inodesFree: 0%
      evictionPressureTransitionPeriod: 0s
      failSwapOn: false
      fileCheckFrequency: 0s
      healthzBindAddress: 127.0.0.1
      healthzPort: 10248
      httpCheckFrequency: 0s
      imageGCHighThresholdPercent: 100
      imageMinimumGCAge: 0s
      kind: KubeletConfiguration
      logging:
        flushFrequency: 0
        options:
          json:
            infoBufferSize: "0"
        verbosity: 0
      memorySwap: {}
      nodeStatusReportFrequency: 0s
      nodeStatusUpdateFrequency: 0s
      rotateCertificates: true
      runtimeRequestTimeout: 0s
      shutdownGracePeriod: 0s
      shutdownGracePeriodCriticalPods: 0s
      staticPodPath: /etc/kubernetes/manifests
      streamingConnectionIdleTimeout: 0s
      syncFrequency: 0s
      volumeStatsAggPeriod: 0s
    audit: /bin/ps -fC kubelet
    auditConfig: /bin/cat /var/lib/kubelet/config.yaml
    auditEnv: ""
    expected_result: '''{range .tlsCipherSuites[:]}{}{'',''}{end}'' is present'
    index: 4.2.13
    isMultiple: "false"
    reason: ""
    remediation: |
      If using a Kubelet config file, edit the file to set `TLSCipherSuites` to
      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
      or to a subset of these values.
      If using executable arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the --tls-cipher-suites parameter as follows, or to a subset of these values.
      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    test_info: |
      If using a Kubelet config file, edit the file to set `TLSCipherSuites` to
      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
      or to a subset of these values.
      If using executable arguments, edit the kubelet service file
      /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
      set the --tls-cipher-suites parameter as follows, or to a subset of these values.
      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
    type: ""
  result: warn
  rule: Kubelet
  source: kube-bench-adapter
  timestamp:
    nanos: 45547198
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the cluster-admin role is only used where required (Manual)
  policy: 5.1.1-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
      if they need this role or if they could use a role with fewer privileges.
      Where possible, first bind users to a lower privileged role and then remove the
      clusterrolebinding to the cluster-admin role :
      kubectl delete clusterrolebinding [name]
    test_info: |
      Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
      if they need this role or if they could use a role with fewer privileges.
      Where possible, first bind users to a lower privileged role and then remove the
      clusterrolebinding to the cluster-admin role :
      kubectl delete clusterrolebinding [name]
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45550069
    seconds: 56
- category: CIS Benchmarks
  message: Minimize access to secrets (Manual)
  policy: 5.1.2-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.2
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Where possible, remove get, list and watch access to Secret objects in the cluster.
    test_info: |
      Where possible, remove get, list and watch access to Secret objects in the cluster.
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45550959
    seconds: 56
- category: CIS Benchmarks
  message: Minimize wildcard use in Roles and ClusterRoles (Manual)
  policy: 5.1.3-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.3
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Where possible replace any use of wildcards in clusterroles and roles with specific
      objects or actions.
    test_info: |
      Where possible replace any use of wildcards in clusterroles and roles with specific
      objects or actions.
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45551790
    seconds: 56
- category: CIS Benchmarks
  message: Minimize access to create pods (Manual)
  policy: 5.1.4-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.4
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Where possible, remove create access to pod objects in the cluster.
    test_info: |
      Where possible, remove create access to pod objects in the cluster.
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45552804
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that default service accounts are not actively used. (Manual)
  policy: 5.1.5-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.5
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Create explicit service accounts wherever a Kubernetes workload requires specific access
      to the Kubernetes API server.
      Modify the configuration of each default service account to include this value
      automountServiceAccountToken: false
    test_info: |
      Create explicit service accounts wherever a Kubernetes workload requires specific access
      to the Kubernetes API server.
      Modify the configuration of each default service account to include this value
      automountServiceAccountToken: false
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45553560
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that Service Account Tokens are only mounted where necessary (Manual)
  policy: 5.1.6-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.6
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Modify the definition of pods and service accounts which do not need to mount service
      account tokens to disable it.
    test_info: |
      Modify the definition of pods and service accounts which do not need to mount service
      account tokens to disable it.
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45554573
    seconds: 56
- category: CIS Benchmarks
  message: Avoid use of system:masters group (Manual)
  policy: 5.1.7-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.7
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Remove the system:masters group from all users in the cluster.
    test_info: |
      Remove the system:masters group from all users in the cluster.
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45557011
    seconds: 56
- category: CIS Benchmarks
  message: Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes
    cluster (Manual)
  policy: 5.1.8-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.1.8
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Where possible, remove the impersonate, bind and escalate rights from subjects.
    test_info: |
      Where possible, remove the impersonate, bind and escalate rights from subjects.
    type: manual
  result: warn
  rule: RBAC and Service Accounts
  source: kube-bench-adapter
  timestamp:
    nanos: 45557734
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the cluster has at least one active policy control mechanism
    in place (Manual)
  policy: 5.2.1-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Ensure that either Pod Security Admission or an external policy control system is in place
      for every namespace which contains user workloads.
    test_info: |
      Ensure that either Pod Security Admission or an external policy control system is in place
      for every namespace which contains user workloads.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45560213
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of privileged containers (Manual)
  policy: 5.2.2-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.2
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of privileged containers.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of privileged containers.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45561039
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers wishing to share the host process
    ID namespace (Automated)
  policy: 5.2.3-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.3
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of `hostPID` containers.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of `hostPID` containers.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45561881
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers wishing to share the host IPC namespace
    (Automated)
  policy: 5.2.4-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.4
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of `hostIPC` containers.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of `hostIPC` containers.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45562580
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers wishing to share the host network
    namespace (Automated)
  policy: 5.2.5-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.5
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of `hostNetwork` containers.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of `hostNetwork` containers.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45563341
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers with allowPrivilegeEscalation (Automated)
  policy: 5.2.6-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.6
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45566093
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of root containers (Automated)
  policy: 5.2.7-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.7
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
      or `MustRunAs` with the range of UIDs not including 0, is set.
    test_info: |
      Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
      or `MustRunAs` with the range of UIDs not including 0, is set.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45566977
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers with the NET_RAW capability (Automated)
  policy: 5.2.8-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.8
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers with the `NET_RAW` capability.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers with the `NET_RAW` capability.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45567741
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers with added capabilities (Automated)
  policy: 5.2.9-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.9
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Ensure that `allowedCapabilities` is not present in policies for the cluster unless
      it is set to an empty array.
    test_info: |
      Ensure that `allowedCapabilities` is not present in policies for the cluster unless
      it is set to an empty array.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45570889
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers with capabilities assigned (Manual)
  policy: 5.2.10-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.10
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Review the use of capabilites in applications running on your cluster. Where a namespace
      contains applicaions which do not require any Linux capabities to operate consider adding
      a PSP which forbids the admission of containers which do not drop all capabilities.
    test_info: |
      Review the use of capabilites in applications running on your cluster. Where a namespace
      contains applicaions which do not require any Linux capabities to operate consider adding
      a PSP which forbids the admission of containers which do not drop all capabilities.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45571793
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of Windows HostProcess containers (Manual)
  policy: 5.2.11-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.11
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45572621
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of HostPath volumes (Manual)
  policy: 5.2.12-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.12
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers with `hostPath` volumes.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers with `hostPath` volumes.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45573254
    seconds: 56
- category: CIS Benchmarks
  message: Minimize the admission of containers which use HostPorts (Manual)
  policy: 5.2.13-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.2.13
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers which use `hostPort` sections.
    test_info: |
      Add policies to each namespace in the cluster which has user workloads to restrict the
      admission of containers which use `hostPort` sections.
    type: manual
  result: warn
  rule: Pod Security Standards
  source: kube-bench-adapter
  timestamp:
    nanos: 45585617
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the CNI in use supports NetworkPolicies (Manual)
  policy: 5.3.1-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.3.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      If the CNI plugin in use does not support network policies, consideration should be given to
      making use of a different plugin, or finding an alternate mechanism for restricting traffic
      in the Kubernetes cluster.
    test_info: |
      If the CNI plugin in use does not support network policies, consideration should be given to
      making use of a different plugin, or finding an alternate mechanism for restricting traffic
      in the Kubernetes cluster.
    type: manual
  result: warn
  rule: Network Policies and CNI
  source: kube-bench-adapter
  timestamp:
    nanos: 45587386
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that all Namespaces have NetworkPolicies defined (Manual)
  policy: 5.3.2-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.3.2
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Follow the documentation and create NetworkPolicy objects as you need them.
    test_info: |
      Follow the documentation and create NetworkPolicy objects as you need them.
    type: manual
  result: warn
  rule: Network Policies and CNI
  source: kube-bench-adapter
  timestamp:
    nanos: 45588626
    seconds: 56
- category: CIS Benchmarks
  message: Prefer using Secrets as files over Secrets as environment variables (Manual)
  policy: 5.4.1-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.4.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      If possible, rewrite application code to read Secrets from mounted secret files, rather than
      from environment variables.
    test_info: |
      If possible, rewrite application code to read Secrets from mounted secret files, rather than
      from environment variables.
    type: manual
  result: warn
  rule: Secrets Management
  source: kube-bench-adapter
  timestamp:
    nanos: 45589917
    seconds: 56
- category: CIS Benchmarks
  message: Consider external secret storage (Manual)
  policy: 5.4.2-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.4.2
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Refer to the Secrets management options offered by your cloud provider or a third-party
      secrets management solution.
    test_info: |
      Refer to the Secrets management options offered by your cloud provider or a third-party
      secrets management solution.
    type: manual
  result: warn
  rule: Secrets Management
  source: kube-bench-adapter
  timestamp:
    nanos: 45591169
    seconds: 56
- category: CIS Benchmarks
  message: Configure Image Provenance using ImagePolicyWebhook admission controller
    (Manual)
  policy: 5.5.1-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.5.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Follow the Kubernetes documentation and setup image provenance.
    test_info: |
      Follow the Kubernetes documentation and setup image provenance.
    type: manual
  result: warn
  rule: Extensible Admission Control
  source: kube-bench-adapter
  timestamp:
    nanos: 45594885
    seconds: 56
- category: CIS Benchmarks
  message: Create administrative boundaries between resources using namespaces (Manual)
  policy: 5.7.1-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.7.1
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Follow the documentation and create namespaces for objects in your deployment as you need
      them.
    test_info: |
      Follow the documentation and create namespaces for objects in your deployment as you need
      them.
    type: manual
  result: warn
  rule: General Policies
  source: kube-bench-adapter
  timestamp:
    nanos: 45740641
    seconds: 56
- category: CIS Benchmarks
  message: Ensure that the seccomp profile is set to docker/default in your Pod definitions
    (Manual)
  policy: 5.7.2-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.7.2
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
      An example is as below:
        securityContext:
          seccompProfile:
            type: RuntimeDefault
    test_info: |
      Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
      An example is as below:
        securityContext:
          seccompProfile:
            type: RuntimeDefault
    type: manual
  result: warn
  rule: General Policies
  source: kube-bench-adapter
  timestamp:
    nanos: 45745764
    seconds: 56
- category: CIS Benchmarks
  message: Apply SecurityContext to your Pods and Containers (Manual)
  policy: 5.7.3-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.7.3
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
      suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
      Containers.
    test_info: |
      Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
      suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
      Containers.
    type: manual
  result: warn
  rule: General Policies
  source: kube-bench-adapter
  timestamp:
    nanos: 45746877
    seconds: 56
- category: CIS Benchmarks
  message: The default namespace should not be used (Manual)
  policy: 5.7.4-Kubernetes Policies
  properties:
    actual_value: ""
    audit: ""
    auditConfig: ""
    auditEnv: ""
    expected_result: ""
    index: 5.7.4
    isMultiple: "false"
    reason: Test marked as a manual test
    remediation: |
      Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
      resources and that all new resources are created in a specific namespace.
    test_info: |
      Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
      resources and that all new resources are created in a specific namespace.
    type: manual
  result: warn
  rule: General Policies
  source: kube-bench-adapter
  timestamp:
    nanos: 45747783
    seconds: 56
summary:
  error: 0
  fail: 11
  pass: 64
  skip: 0
  warn: 49