Support CIS Kubernetes Benchmark 1.5.1

[mozillazg]

How about support CIS Kubernetes Benchmark 1.5.1?

[lizrice]

Are there any changes from 1.5.0 to 1.5.1? The change history appendix is empty... I guess we might be able to tell by doing a comparison of the XLS versions for these two versions of the spec

[yoavrotems]

I think we just should update cis-1.5 for those small changes

[lizrice]

Agreed, let's make these as changes to the existing cis-1.5 tests (we don't need to maintain separate 1.5.0 and 1.5.1 versions)

[yoavrotems]

@mozillazg and I just come through one test where there is a different, #641 here you can see the audit commend is different

[mozillazg]

Are there any changes from 1.5.0 to 1.5.1? The change history appendix is empty... I guess we might be able to tell by doing a comparison of the XLS versions for these two versions of the spec

@lizrice @yoavrotems After reviewed the 1.5.0 and 1.5.1, here are the changes from 1.5.0 to 1.5.1:

1.5.0	1.5.1	changes
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored) audit: ls -laR /etc/kubernetes/pki/*.crt	1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Not Scored) audit: find /etc/kubernetes/pki -name "*.crt" | xargs stat -c '%n %a'	* Scored -> Not Scored * audit command is changed
1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Scored) audit: ls -laR /etc/kubernetes/pki/*.key	1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Not Scored) audit: find /etc/kubernetes/pki -name "*.key" | xargs stat -c '%n %a'	* Scored -> Not Scored * audit command changed
1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)	1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)	Scored -> Not Scored
1.2.34 Ensure that encryption providers are appropriately configured (Scored)	1.2.34 Ensure that encryption providers are appropriately configured (Not Scored)	Scored -> Not Scored
1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)	1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Not Scored)	Scored -> Not Scored
4.2.1 Ensure that the --anonymous-auth argument is set to false (Scored)	4.2.1 Ensure that the anonymous-auth argument is set to false (Scored)	title is changed(looks like it's an typo)
5.6 General Policies	5.7 General Policies	title number is changed(looks like it's an typo)
5.6.1 Create administrative boundaries between resources using namespaces (Not Scored)	5.7.1 Create administrative boundaries between resources using namespaces (Not Scored)	title number is changed(looks like it's an typo)
5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)	5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)	title number is changed(looks like it's an typo)
5.6.3 Apply Security Context to Your Pods and Containers (Not Scored)	5.7.3 Apply Security Context to Your Pods and Containers (Not Scored)	title number is changed(looks like it's an typo)
5.6.4 The default namespace should not be used (Scored)	5.7.4 The default namespace should not be used (Scored)	title number is changed(looks like it's an typo)

[yoavrotems]

Wow really good job! :)
I think we should open issue about those changes, and open a ticket in CIS site about the title numbering issue

[lizrice]

This is really helpful @mozillazg, thank you!

I think you're right that changing the test numbers 5.6 -> 5.7 was probably a typo. The easiest thing would be for us to just change kube-bench to match what's in the new spec. Same for the title in 4.2.1, let's just match what the benchmark says. I've raised issue #669 to track these changes.

[lizrice]

Support for this is now merged #673