diff --git a/cfg/1.11-json/node.yaml b/cfg/1.11-json/node.yaml
index 9dfc65c432c73ee7a5c6ab89a6a3f1a39509f219..f85687d79e634b0be1708d2c5860670daa4c9889 100644
--- a/cfg/1.11-json/node.yaml
+++ b/cfg/1.11-json/node.yaml
@@ -462,8 +462,14 @@ groups:
- id: 2.2.8
text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
- audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
- type: manual
+ audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+ tests:
+ test_items:
+ - flag: "root:root"
+ compare:
+ op: eq
+ value: root:root
+ set: true
remediation: |
Run the following command to modify the ownership of the --client-ca-file .
chown root:root <filename>
diff --git a/cfg/1.11/node.yaml b/cfg/1.11/node.yaml
index 0a9ba8e6dd774d62eb43e2257a5ea288dab431c8..01faf1ea9634228625c4f41fa815ba590a8e2fd5 100644
--- a/cfg/1.11/node.yaml
+++ b/cfg/1.11/node.yaml
@@ -453,8 +453,14 @@ groups:
- id: 2.2.8
text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
- audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
- type: manual
+ audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+ tests:
+ test_items:
+ - flag: "root:root"
+ compare:
+ op: eq
+ value: root:root
+ set: true
remediation: |
Run the following command to modify the ownership of the --client-ca-file .
chown root:root <filename>
diff --git a/cfg/1.13/node.yaml b/cfg/1.13/node.yaml
index 146989907f6b7b5fa9146d47aeca45ba40124b9a..865c96ebf2c00e75b88fc671d86c0ffb0f9d313b 100644
--- a/cfg/1.13/node.yaml
+++ b/cfg/1.13/node.yaml
@@ -434,8 +434,14 @@ groups:
- id: 2.2.8
text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
- audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
- type: manual
+ audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+ tests:
+ test_items:
+ - flag: "root:root"
+ compare:
+ op: eq
+ value: root:root
+ set: true
remediation: |
Run the following command to modify the ownership of the --client-ca-file .
chown root:root <filename>
diff --git a/cfg/1.8/node.yaml b/cfg/1.8/node.yaml
index 05edbfeee188d9b5e699c273b77d0c9598e58201..7740d72dae96c916dd49aa4a32508d0014cb378a 100644
--- a/cfg/1.8/node.yaml
+++ b/cfg/1.8/node.yaml
@@ -430,9 +430,15 @@ groups:
scored: true
- id: 2.2.8
- text: "Ensure that the client certificate authorities file ownership is set to root:root"
- audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
- type: manual
+ text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
+ audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+ tests:
+ test_items:
+ - flag: "root:root"
+ compare:
+ op: eq
+ value: root:root
+ set: true
remediation: |
Run the following command to modify the ownership of the --client-ca-file .
chown root:root <filename>
diff --git a/cfg/config.yaml b/cfg/config.yaml
index 340b90540fad2b91ce711d43b12837847c9352d7..a538f84b1d00a77f7d7c38c178ecacfa5517a046 100644
--- a/cfg/config.yaml
+++ b/cfg/config.yaml
@@ -81,6 +81,8 @@ node:
defaultconf: /etc/kubernetes/config
kubelet:
+ cafile:
+ - "/etc/kubernetes/pki/ca.crt"
bins:
- "hyperkube kubelet"
- "kubelet"
@@ -91,6 +93,7 @@ node:
defaultconf: "/var/lib/kubelet/config.yaml"
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
+ defaultcafile: "/etc/kubernetes/pki/ca.crt"
proxy:
bins:
diff --git a/cmd/common.go b/cmd/common.go
index 9297ea7e5bacabaaf63f12bb583f9d7c38614579..41e5cd7d6d05b5807e8419712d678aad3384393c 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -85,6 +85,7 @@ func runChecks(nodetype check.NodeType) {
confmap := getConfigFiles(typeConf)
svcmap := getServiceFiles(typeConf)
kubeconfmap := getKubeConfigFiles(typeConf)
+ cafilemap := getCaFile(typeConf)
// Variable substitutions. Replace all occurrences of variables in controls files.
s := string(in)
@@ -92,6 +93,7 @@ func runChecks(nodetype check.NodeType) {
s = makeSubstitutions(s, "conf", confmap)
s = makeSubstitutions(s, "svc", svcmap)
s = makeSubstitutions(s, "kubeconfig", kubeconfmap)
+ s = makeSubstitutions(s, "cafile", cafilemap)
controls, err := check.NewControls(nodetype, []byte(s))
if err != nil {
diff --git a/cmd/util.go b/cmd/util.go
index f2a34f34aebb3fdcb38ff03dca23e86a29e2f246..28490d9efd80cafb3eeccda9e550bc9be17ce6a4 100644
--- a/cmd/util.go
+++ b/cmd/util.go
@@ -258,6 +258,35 @@ func getKubeConfigFiles(v *viper.Viper) map[string]string {
return kubeconfigmap
}
+// getCaFile finds which of the set of client certificate authorities files exist
+func getCaFile(v *viper.Viper) map[string]string {
+ cafilemap := make(map[string]string)
+
+ for _, component := range v.GetStringSlice("components") {
+ s := v.Sub(component)
+ if s == nil {
+ continue
+ }
+
+ cafile := findConfigFile(s.GetStringSlice("cafile"))
+ if cafile == "" {
+ if s.IsSet("defaultcafile") {
+ cafile = s.GetString("defaultcafile")
+ glog.V(2).Info(fmt.Sprintf("Using default client CA file name '%s' for component %s", cafile, component))
+ } else {
+ glog.V(2).Info(fmt.Sprintf("Missing client CA file for %s", component))
+ cafile = component
+ }
+ } else {
+ glog.V(2).Info(fmt.Sprintf("Component %s uses client CA file '%s'", component, cafile))
+ }
+
+ cafilemap[component] = cafile
+ }
+
+ return cafilemap
+}
+
// verifyBin checks that the binary specified is running
func verifyBin(bin string) bool {