diff --git a/cfg/1.11/master.yaml b/cfg/1.11/master.yaml index b5922954d88dd02deec9e5f2cb6ae6c91871053a..02ebd471fc76fdcbe2ef36dc6d2b204c67136ccc 100644 --- a/cfg/1.11/master.yaml +++ b/cfg/1.11/master.yaml @@ -613,7 +613,7 @@ groups: --admission-control-config-file=<path/to/configuration/file> scored: true - - id: 1.1.37 + - id: 1.1.37a text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" tests: @@ -633,6 +633,23 @@ groups: --audit-policy-file=/etc/kubernetes/audit-policy.yaml scored: true + - id: 1.1.37b + text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" + audit: "ps -ef | grep $apiserverbin | grep -v grep" + tests: + test_items: + - flag: "--audit-policy-file" + compare: + op: eq + value: "/etc/kubernetes/audit-policy.yaml" + set: true + remediation: | + Follow the Kubernetes documentation and set the desired audit policy in the + /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf + and set the below parameters. + --audit-policy-file=/etc/kubernetes/audit-policy.yaml + scored: true + - id: 1.1.38 text: "Ensure that the --request-timeout argument is set as appropriate (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" diff --git a/cfg/1.13/master.yaml b/cfg/1.13/master.yaml index 3402aa8a935eec43dfea397309cad274e82f1f39..57fc20d4bc35e35a725a905d9fc09b589e47eef4 100644 --- a/cfg/1.13/master.yaml +++ b/cfg/1.13/master.yaml @@ -618,7 +618,7 @@ groups: --admission-control-config-file=<path/to/configuration/file> scored: true - - id: 1.1.37 + - id: 1.1.37a text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" tests: @@ -638,6 +638,23 @@ groups: --audit-policy-file=/etc/kubernetes/audit-policy.yaml scored: true + - id: 1.1.37b + text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" + audit: "ps -ef | grep $apiserverbin | grep -v grep" + tests: + test_items: + - flag: "--audit-policy-file" + compare: + op: eq + value: "/etc/kubernetes/audit-policy.yaml" + set: true + remediation: | + Follow the Kubernetes documentation and set the desired audit policy in the + /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf + and set the below parameters. + --audit-policy-file=/etc/kubernetes/audit-policy.yaml + scored: true + - id: 1.1.38 text: "Ensure that the --request-timeout argument is set as appropriate (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep"