EKS: Provide assessments and rules for CIS section 3 #7977
Conversation
JAORMX
changed the title
openshift-ci
bot
added
the
do-not-merge/work-in-progress
JAORMX
force-pushed
the
eks-cis-3
branch
3 times, most recently
from
047bae6 to
2a33680
Compare
JAORMX
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/retest |
1 similar comment
|
/retest |
| do | ||
| mkdir -p $(dirname $path) | ||
| echo $kubeconfig > $path | ||
| cat $path |
There was a problem hiding this comment.
was cat $path for testing haha
There was a problem hiding this comment.
lol oops! let me remove it!
|
/retest |
| {{%- set kubeletconf_path = "/etc/kubernetes/kubelet/kubelet-config.json" %}} | ||
| {{%- else %}} | ||
| {{%- set kubeletconf_path = "/etc/kubernetes/kubelet.conf" %}} | ||
| {{%- endif %}} |
There was a problem hiding this comment.
I wonder if there is a way to reduce this duplication across rules.
There was a problem hiding this comment.
We might need an enhancement in ComplianceAsCode to be able to set product-wide variables. that would be useful.
Most of these already had automation in OpenShift, so we're just re-using it. Some required a new rule (e.g. `kubelet_read_only_port_secured`). While for other controls, we re-introduced a rule that had been previously deleted (e.g. `kubelet_disable_hostname_override`). Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
|
/retest |
2 similar comments
|
/retest |
|
/retest |
|
@JAORMX: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Most of these already had automation in OpenShift, so we're just
re-using it.
Some required a new rule (e.g.
kubelet_read_only_port_secured).While for other controls, we re-introduced a rule that had been
previously deleted (e.g.
kubelet_disable_hostname_override).Signed-off-by: Juan Antonio Osorio Robles jaosorior@redhat.com