kube-bench.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "b94d6956",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "d01b4c99",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "go: downloading github.com/aquasecurity/kube-bench v0.6.6\n",
      "go: downloading gorm.io/driver/postgres v1.2.2\n",
      "go: downloading github.com/aws/aws-sdk-go v1.42.14\n",
      "go: downloading github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b\n",
      "go: downloading github.com/spf13/cobra v1.3.0\n",
      "go: downloading github.com/fatih/color v1.13.0\n",
      "go: downloading github.com/spf13/viper v1.10.0\n",
      "go: downloading gorm.io/gorm v1.22.3\n",
      "go: downloading github.com/pkg/errors v0.9.1\n",
      "go: downloading github.com/onsi/ginkgo v1.16.5\n",
      "go: downloading gopkg.in/yaml.v2 v2.4.0\n",
      "go: downloading k8s.io/client-go v0.23.1\n",
      "go: downloading github.com/mattn/go-colorable v0.1.12\n",
      "go: downloading github.com/mattn/go-isatty v0.0.14\n",
      "go: downloading github.com/jackc/pgx/v4 v4.13.0\n",
      "go: downloading github.com/inconshreveable/mousetrap v1.0.0\n",
      "go: downloading github.com/spf13/pflag v1.0.5\n",
      "go: downloading github.com/fsnotify/fsnotify v1.5.1\n",
      "go: downloading github.com/magiconair/properties v1.8.5\n",
      "go: downloading github.com/mitchellh/mapstructure v1.4.3\n",
      "go: downloading github.com/spf13/afero v1.6.0\n",
      "go: downloading github.com/spf13/cast v1.4.1\n",
      "go: downloading github.com/spf13/jwalterweatherman v1.1.0\n",
      "go: downloading github.com/subosito/gotenv v1.2.0\n",
      "go: downloading gopkg.in/ini.v1 v1.66.2\n",
      "go: downloading golang.org/x/sys v0.0.0-20211205182925-97ca703d548d\n",
      "go: downloading github.com/jinzhu/inflection v1.0.0\n",
      "go: downloading github.com/jinzhu/now v1.1.2\n",
      "go: downloading github.com/hashicorp/hcl v1.0.0\n",
      "go: downloading github.com/pelletier/go-toml v1.9.4\n",
      "go: downloading golang.org/x/text v0.3.7\n",
      "go: downloading github.com/jackc/pgconn v1.10.0\n",
      "go: downloading github.com/jackc/pgtype v1.8.1\n",
      "go: downloading github.com/jackc/pgio v1.0.0\n",
      "go: downloading github.com/jackc/pgproto3/v2 v2.1.1\n",
      "go: downloading github.com/jackc/chunkreader/v2 v2.0.1\n",
      "go: downloading github.com/jackc/pgpassfile v1.0.0\n",
      "go: downloading github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b\n",
      "go: downloading golang.org/x/crypto v0.0.0-20210921155107-089bfa567519\n",
      "go: downloading github.com/jackc/chunkreader v1.0.0\n",
      "go: downloading github.com/jackc/pgproto3 v1.1.0\n",
      "go: downloading github.com/jmespath/go-jmespath v0.4.0\n",
      "go get: installing executables with 'go get' in module mode is deprecated.\n",
      "\tUse 'go install pkg@version' instead.\n",
      "\tFor more information, see https://golang.org/doc/go-get-install-deprecation\n",
      "\tor run 'go help get' or 'go help install'.\n",
      "golang.org/x/sys/internal/unsafeheader\n",
      "github.com/aws/aws-sdk-go/aws/client/metadata\n",
      "github.com/aws/aws-sdk-go/internal/sdkmath\n",
      "github.com/spf13/viper/internal/encoding\n",
      "github.com/aws/aws-sdk-go/internal/sync/singleflight\n",
      "github.com/hashicorp/hcl/hcl/strconv\n",
      "golang.org/x/text/internal/tag\n",
      "github.com/aws/aws-sdk-go/internal/sdkio\n",
      "golang.org/x/text/transform\n",
      "github.com/jackc/chunkreader/v2\n",
      "golang.org/x/crypto/pbkdf2\n",
      "github.com/aws/aws-sdk-go/internal/strings\n",
      "github.com/aws/aws-sdk-go/internal/sdkuri\n",
      "github.com/jinzhu/inflection\n",
      "github.com/aws/aws-sdk-go/aws/awserr\n",
      "github.com/aws/aws-sdk-go/internal/shareddefaults\n",
      "github.com/jmespath/go-jmespath\n",
      "github.com/aws/aws-sdk-go/internal/sdkrand\n",
      "github.com/onsi/ginkgo/config\n",
      "github.com/onsi/ginkgo/formatter\n",
      "github.com/golang/glog\n",
      "github.com/spf13/afero/mem\n",
      "golang.org/x/sys/unix\n",
      "github.com/mitchellh/mapstructure\n",
      "github.com/spf13/jwalterweatherman\n",
      "github.com/spf13/pflag\n",
      "github.com/spf13/cast\n",
      "github.com/magiconair/properties\n",
      "github.com/hashicorp/hcl/hcl/token\n",
      "github.com/spf13/viper/internal/encoding/json\n",
      "github.com/aws/aws-sdk-go/internal/ini\n",
      "github.com/aws/aws-sdk-go/aws/endpoints\n",
      "github.com/pelletier/go-toml\n",
      "golang.org/x/text/unicode/norm\n",
      "github.com/onsi/ginkgo/types\n",
      "gopkg.in/yaml.v2\n",
      "github.com/hashicorp/hcl/hcl/ast\n",
      "github.com/hashicorp/hcl/hcl/scanner\n",
      "github.com/hashicorp/hcl/json/token\n",
      "github.com/hashicorp/hcl/json/scanner\n",
      "github.com/subosito/gotenv\n",
      "gopkg.in/ini.v1\n",
      "github.com/hashicorp/hcl/json/parser\n",
      "github.com/hashicorp/hcl/hcl/parser\n",
      "github.com/onsi/ginkgo/reporters/stenographer\n",
      "k8s.io/client-go/third_party/forked/golang/template\n",
      "github.com/pkg/errors\n",
      "github.com/jackc/pgconn/internal/ctxwatch\n",
      "github.com/jackc/pgio\n",
      "github.com/jackc/pgpassfile\n",
      "github.com/jackc/pgproto3/v2\n",
      "github.com/jackc/pgservicefile\n",
      "github.com/aws/aws-sdk-go/aws/credentials\n",
      "golang.org/x/text/internal/language\n",
      "golang.org/x/text/runes\n",
      "github.com/hashicorp/hcl\n",
      "github.com/aws/aws-sdk-go/aws/awsutil\n",
      "github.com/hashicorp/hcl/hcl/printer\n",
      "golang.org/x/text/unicode/bidi\n",
      "k8s.io/client-go/util/jsonpath\n",
      "github.com/onsi/ginkgo/reporters\n",
      "golang.org/x/text/width\n",
      "github.com/jackc/pgtype\n",
      "github.com/jackc/pgx/v4/internal/sanitize\n",
      "github.com/aws/aws-sdk-go/aws/credentials/processcreds\n",
      "gorm.io/gorm/clause\n",
      "gorm.io/gorm/utils\n",
      "github.com/jinzhu/now\n",
      "golang.org/x/text/internal/language/compact\n",
      "github.com/spf13/cobra\n",
      "github.com/spf13/viper/internal/encoding/hcl\n",
      "gorm.io/gorm/logger\n",
      "github.com/fsnotify/fsnotify\n",
      "github.com/mattn/go-isatty\n",
      "github.com/spf13/afero\n",
      "golang.org/x/text/secure/bidirule\n",
      "github.com/mattn/go-colorable\n",
      "golang.org/x/text/language\n",
      "gorm.io/gorm/schema\n",
      "github.com/fatih/color\n",
      "github.com/spf13/viper/internal/encoding/toml\n",
      "github.com/spf13/viper/internal/encoding/yaml\n",
      "golang.org/x/text/internal\n",
      "golang.org/x/text/cases\n",
      "gorm.io/gorm\n",
      "github.com/spf13/viper\n",
      "golang.org/x/text/secure/precis\n",
      "github.com/jackc/pgconn\n",
      "gorm.io/gorm/migrator\n",
      "gorm.io/gorm/callbacks\n",
      "github.com/jackc/pgconn/stmtcache\n",
      "github.com/jackc/pgx/v4\n",
      "github.com/jackc/pgx/v4/stdlib\n",
      "gorm.io/driver/postgres\n",
      "github.com/aws/aws-sdk-go/aws\n",
      "github.com/aws/aws-sdk-go/aws/request\n",
      "github.com/aws/aws-sdk-go/aws/client\n",
      "github.com/aws/aws-sdk-go/aws/corehandlers\n",
      "github.com/aws/aws-sdk-go/private/protocol\n",
      "github.com/aws/aws-sdk-go/aws/csm\n",
      "github.com/aws/aws-sdk-go/aws/ec2metadata\n",
      "github.com/aws/aws-sdk-go/private/protocol/rest\n",
      "github.com/aws/aws-sdk-go/private/protocol/query/queryutil\n",
      "github.com/aws/aws-sdk-go/private/protocol/json/jsonutil\n",
      "github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil\n",
      "github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds\n",
      "github.com/aws/aws-sdk-go/private/protocol/query\n",
      "github.com/aws/aws-sdk-go/aws/credentials/endpointcreds\n",
      "github.com/aws/aws-sdk-go/private/protocol/jsonrpc\n",
      "github.com/aws/aws-sdk-go/aws/signer/v4\n",
      "github.com/aws/aws-sdk-go/private/protocol/restjson\n",
      "github.com/aws/aws-sdk-go/aws/defaults\n",
      "github.com/aws/aws-sdk-go/service/sso\n",
      "github.com/aws/aws-sdk-go/service/sts\n",
      "github.com/aws/aws-sdk-go/service/securityhub\n",
      "github.com/aws/aws-sdk-go/service/sso/ssoiface\n",
      "github.com/aws/aws-sdk-go/service/sts/stsiface\n",
      "github.com/aws/aws-sdk-go/aws/credentials/ssocreds\n",
      "github.com/aws/aws-sdk-go/aws/credentials/stscreds\n",
      "github.com/aws/aws-sdk-go/aws/session\n",
      "github.com/aquasecurity/kube-bench/check\n",
      "github.com/aws/aws-sdk-go/service/securityhub/securityhubiface\n",
      "github.com/aquasecurity/kube-bench/internal/findings\n",
      "github.com/aquasecurity/kube-bench/cmd\n",
      "github.com/aquasecurity/kube-bench\n"
     ]
    }
   ],
   "source": [
    "go get -v github.com/aquasecurity/kube-bench"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "2ad54530",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "unable to determine benchmark version: config file is missing 'version_mapping' section\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kube-bench"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1ace6157-deb2-4964-82df-812165845c48",
   "metadata": {},
   "outputs": [],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "7f12b2c5-882f-48bf-9185-401cbb4360ea",
   "metadata": {},
   "outputs": [],
   "source": [
    "cd .."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e9e03ee4-b745-456b-9237-f6275f53f25e",
   "metadata": {},
   "outputs": [],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "8a82777a-b16e-4bbe-bcde-4efbb07a94ae",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Cloning into 'kube-bench'...\n",
      "remote: Enumerating objects: 4282, done.        \n",
      "remote: Counting objects: 100% (87/87), done.        \n",
      "remote: Compressing objects: 100% (61/61), done.        \n",
      "remote: Total 4282 (delta 27), reused 55 (delta 11), pack-reused 4195        \n",
      "Receiving objects: 100% (4282/4282), 8.63 MiB | 16.89 MiB/s, done.\n",
      "Resolving deltas: 100% (2674/2674), done.\n"
     ]
    }
   ],
   "source": [
    "git clone https://github.com/aquasecurity/kube-bench"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "6b2955cb",
   "metadata": {},
   "outputs": [],
   "source": [
    "cd kube-bench"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "09ec5005-465b-42e9-9bbb-45c83e833d2d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "job.batch/kube-bench created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f job.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "57973fbb-b314-4524-b8e3-959bb016b65e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                            READY   STATUS      RESTARTS   AGE\n",
      "kube-bench--1-cqzmb             0/1     Completed   0          3m15s\n",
      "nginx-strict-5cdc48cf55-jmjhj   1/1     Running     0          17h\n",
      "nginx-strict-5cdc48cf55-rr4kc   1/1     Running     0          17h\n",
      "nginx-strict-5cdc48cf55-vz7ds   1/1     Running     0          17h\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "57f48e4c-0f00-4ff8-97bc-d28b15ea2277",
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[INFO] 1 Master Node Security Configuration\n",
      "[INFO] 1.1 Master Node Configuration Files\n",
      "[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated)\n",
      "[PASS] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated)\n",
      "[PASS] 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated)\n",
      "[PASS] 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated)\n",
      "[WARN] 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)\n",
      "[WARN] 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual)\n",
      "[FAIL] 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)\n",
      "[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)\n",
      "[PASS] 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated)\n",
      "[PASS] 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated)\n",
      "[PASS] 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated)\n",
      "[FAIL] 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)\n",
      "[WARN] 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)\n",
      "[WARN] 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)\n",
      "[INFO] 1.2 API Server\n",
      "[WARN] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)\n",
      "[PASS] 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated)\n",
      "[PASS] 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated)\n",
      "[PASS] 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)\n",
      "[PASS] 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)\n",
      "[FAIL] 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)\n",
      "[PASS] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)\n",
      "[PASS] 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)\n",
      "[PASS] 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)\n",
      "[WARN] 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)\n",
      "[PASS] 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)\n",
      "[WARN] 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)\n",
      "[WARN] 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)\n",
      "[PASS] 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)\n",
      "[PASS] 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)\n",
      "[FAIL] 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated)\n",
      "[PASS] 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated)\n",
      "[PASS] 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated)\n",
      "[FAIL] 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated)\n",
      "[PASS] 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated)\n",
      "[FAIL] 1.2.21 Ensure that the --profiling argument is set to false (Automated)\n",
      "[FAIL] 1.2.22 Ensure that the --audit-log-path argument is set (Automated)\n",
      "[FAIL] 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)\n",
      "[FAIL] 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)\n",
      "[FAIL] 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)\n",
      "[WARN] 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated)\n",
      "[PASS] 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated)\n",
      "[PASS] 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated)\n",
      "[PASS] 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)\n",
      "[PASS] 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)\n",
      "[PASS] 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated)\n",
      "[PASS] 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated)\n",
      "[WARN] 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)\n",
      "[WARN] 1.2.34 Ensure that encryption providers are appropriately configured (Manual)\n",
      "[WARN] 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)\n",
      "[INFO] 1.3 Controller Manager\n",
      "[WARN] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)\n",
      "[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Automated)\n",
      "[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)\n",
      "[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)\n",
      "[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)\n",
      "[PASS] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)\n",
      "[PASS] 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)\n",
      "[INFO] 1.4 Scheduler\n",
      "[FAIL] 1.4.1 Ensure that the --profiling argument is set to false (Automated)\n",
      "[PASS] 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)\n",
      "\n",
      "== Remediations master ==\n",
      "1.1.9 Run the below command (based on the file location on your system) on the master node.\n",
      "For example,\n",
      "chmod 644 <path/to/cni/files>\n",
      "\n",
      "1.1.10 Run the below command (based on the file location on your system) on the master node.\n",
      "For example,\n",
      "chown root:root <path/to/cni/files>\n",
      "\n",
      "1.1.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\n",
      "from the below command:\n",
      "ps -ef | grep etcd\n",
      "Run the below command (based on the etcd data directory found above). For example,\n",
      "chmod 700 /var/lib/etcd\n",
      "\n",
      "1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\n",
      "from the below command:\n",
      "ps -ef | grep etcd\n",
      "Run the below command (based on the etcd data directory found above).\n",
      "For example, chown etcd:etcd /var/lib/etcd\n",
      "\n",
      "1.1.19 Run the below command (based on the file location on your system) on the master node.\n",
      "For example,\n",
      "chown -R root:root /etc/kubernetes/pki/\n",
      "\n",
      "1.1.20 audit test did not run: failed to run: \"find /etc/kubernetes/pki -name '*.crt' | xargs stat -c permissions=%a\", output: \"find: /etc/kubernetes/pki: No such file or directory\\nBusyBox v1.32.1 () multi-call binary.\\n\\nUsage: stat [OPTIONS] FILE...\\n\\nDisplay file (default) or filesystem status\\n\\n\\t-c FMT\\tUse the specified format\\n\\t-f\\tDisplay filesystem status\\n\\t-L\\tFollow links\\n\\t-t\\tTerse display\\n\\nFMT sequences for files:\\n %a\\tAccess rights in octal\\n %A\\tAccess rights in human readable form\\n %b\\tNumber of blocks allocated (see %B)\\n %B\\tSize in bytes of each block reported by %b\\n %d\\tDevice number in decimal\\n %D\\tDevice number in hex\\n %f\\tRaw mode in hex\\n %F\\tFile type\\n %g\\tGroup ID\\n %G\\tGroup name\\n %h\\tNumber of hard links\\n %i\\tInode number\\n %n\\tFile name\\n %N\\tFile name, with -> TARGET if symlink\\n %o\\tI/O block size\\n %s\\tTotal size in bytes\\n %t\\tMajor device type in hex\\n %T\\tMinor device type in hex\\n %u\\tUser ID\\n %U\\tUser name\\n %x\\tTime of last access\\n %X\\tTime of last access as seconds since Epoch\\n %y\\tTime of last modification\\n %Y\\tTime of last modification as seconds since Epoch\\n %z\\tTime of last change\\n %Z\\tTime of last change as seconds since Epoch\\n\\nFMT sequences for file systems:\\n %a\\tFree blocks available to non-superuser\\n %b\\tTotal data blocks\\n %c\\tTotal file nodes\\n %d\\tFree file nodes\\n %f\\tFree blocks\\n %i\\tFile System ID in hex\\n %l\\tMaximum length of filenames\\n %n\\tFile name\\n %s\\tBlock size (for faster transfer)\\n %S\\tFundamental block size (for block counts)\\n %t\\tType in hex\\n %T\\tType in human readable form\\n\", error: exit status 123\n",
      "1.1.21 audit test did not run: failed to run: \"find /etc/kubernetes/pki -name '*.key' | xargs stat -c permissions=%a\", output: \"find: /etc/kubernetes/pki: No such file or directory\\nBusyBox v1.32.1 () multi-call binary.\\n\\nUsage: stat [OPTIONS] FILE...\\n\\nDisplay file (default) or filesystem status\\n\\n\\t-c FMT\\tUse the specified format\\n\\t-f\\tDisplay filesystem status\\n\\t-L\\tFollow links\\n\\t-t\\tTerse display\\n\\nFMT sequences for files:\\n %a\\tAccess rights in octal\\n %A\\tAccess rights in human readable form\\n %b\\tNumber of blocks allocated (see %B)\\n %B\\tSize in bytes of each block reported by %b\\n %d\\tDevice number in decimal\\n %D\\tDevice number in hex\\n %f\\tRaw mode in hex\\n %F\\tFile type\\n %g\\tGroup ID\\n %G\\tGroup name\\n %h\\tNumber of hard links\\n %i\\tInode number\\n %n\\tFile name\\n %N\\tFile name, with -> TARGET if symlink\\n %o\\tI/O block size\\n %s\\tTotal size in bytes\\n %t\\tMajor device type in hex\\n %T\\tMinor device type in hex\\n %u\\tUser ID\\n %U\\tUser name\\n %x\\tTime of last access\\n %X\\tTime of last access as seconds since Epoch\\n %y\\tTime of last modification\\n %Y\\tTime of last modification as seconds since Epoch\\n %z\\tTime of last change\\n %Z\\tTime of last change as seconds since Epoch\\n\\nFMT sequences for file systems:\\n %a\\tFree blocks available to non-superuser\\n %b\\tTotal data blocks\\n %c\\tTotal file nodes\\n %d\\tFree file nodes\\n %f\\tFree blocks\\n %i\\tFile System ID in hex\\n %l\\tMaximum length of filenames\\n %n\\tFile name\\n %s\\tBlock size (for faster transfer)\\n %S\\tFundamental block size (for block counts)\\n %t\\tType in hex\\n %T\\tType in human readable form\\n\", error: exit status 123\n",
      "1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--anonymous-auth=false\n",
      "\n",
      "1.2.6 Follow the Kubernetes documentation and setup the TLS connection between\n",
      "the apiserver and kubelets. Then, edit the API server pod specification file\n",
      "/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the\n",
      "--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.\n",
      "--kubelet-certificate-authority=<ca-string>\n",
      "\n",
      "1.2.10 Follow the Kubernetes documentation and set the desired limits in a configuration file.\n",
      "Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "and set the below parameters.\n",
      "--enable-admission-plugins=...,EventRateLimit,...\n",
      "--admission-control-config-file=<path/to/configuration/file>\n",
      "\n",
      "1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --enable-admission-plugins parameter to include\n",
      "AlwaysPullImages.\n",
      "--enable-admission-plugins=...,AlwaysPullImages,...\n",
      "\n",
      "1.2.13 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --enable-admission-plugins parameter to include\n",
      "SecurityContextDeny, unless PodSecurityPolicy is already in place.\n",
      "--enable-admission-plugins=...,SecurityContextDeny,...\n",
      "\n",
      "1.2.16 Follow the documentation and create Pod Security Policy objects as per your environment.\n",
      "Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --enable-admission-plugins parameter to a\n",
      "value that includes PodSecurityPolicy:\n",
      "--enable-admission-plugins=...,PodSecurityPolicy,...\n",
      "Then restart the API Server.\n",
      "\n",
      "1.2.19 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--insecure-port=0\n",
      "\n",
      "1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--profiling=false\n",
      "\n",
      "1.2.22 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-path parameter to a suitable path and\n",
      "file where you would like audit logs to be written, for example:\n",
      "--audit-log-path=/var/log/apiserver/audit.log\n",
      "\n",
      "1.2.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days:\n",
      "--audit-log-maxage=30\n",
      "\n",
      "1.2.24 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate\n",
      "value.\n",
      "--audit-log-maxbackup=10\n",
      "\n",
      "1.2.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB.\n",
      "For example, to set it as 100 MB:\n",
      "--audit-log-maxsize=100\n",
      "\n",
      "1.2.26 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "and set the below parameter as appropriate and if needed.\n",
      "For example,\n",
      "--request-timeout=300s\n",
      "\n",
      "1.2.33 Follow the Kubernetes documentation and configure a EncryptionConfig file.\n",
      "Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>\n",
      "\n",
      "1.2.34 Follow the Kubernetes documentation and configure a EncryptionConfig file.\n",
      "In this file, choose aescbc, kms or secretbox as the encryption provider.\n",
      "\n",
      "1.2.35 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n",
      "_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n",
      "_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n",
      "_SHA384\n",
      "\n",
      "1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\n",
      "on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold,\n",
      "for example:\n",
      "--terminated-pod-gc-threshold=10\n",
      "\n",
      "1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\n",
      "on the master node and set the below parameter.\n",
      "--profiling=false\n",
      "\n",
      "1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file\n",
      "on the master node and set the below parameter.\n",
      "--profiling=false\n",
      "\n",
      "\n",
      "== Summary master ==\n",
      "39 checks PASS\n",
      "13 checks FAIL\n",
      "13 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "[INFO] 2 Etcd Node Configuration\n",
      "[INFO] 2 Etcd Node Configuration Files\n",
      "[PASS] 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)\n",
      "[PASS] 2.2 Ensure that the --client-cert-auth argument is set to true (Automated)\n",
      "[PASS] 2.3 Ensure that the --auto-tls argument is not set to true (Automated)\n",
      "[PASS] 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)\n",
      "[PASS] 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)\n",
      "[PASS] 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)\n",
      "[PASS] 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)\n",
      "\n",
      "== Summary etcd ==\n",
      "7 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "[INFO] 3 Control Plane Configuration\n",
      "[INFO] 3.1 Authentication and Authorization\n",
      "[WARN] 3.1.1 Client certificate authentication should not be used for users (Manual)\n",
      "[INFO] 3.2 Logging\n",
      "[WARN] 3.2.1 Ensure that a minimal audit policy is created (Manual)\n",
      "[WARN] 3.2.2 Ensure that the audit policy covers key security concerns (Manual)\n",
      "\n",
      "== Remediations controlplane ==\n",
      "3.1.1 Alternative mechanisms provided by Kubernetes such as the use of OIDC should be\n",
      "implemented in place of client certificates.\n",
      "\n",
      "3.2.1 Create an audit policy file for your cluster.\n",
      "\n",
      "3.2.2 Consider modification of the audit policy in use on the cluster to include these items, at a\n",
      "minimum.\n",
      "\n",
      "\n",
      "== Summary controlplane ==\n",
      "0 checks PASS\n",
      "0 checks FAIL\n",
      "3 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "[INFO] 4 Worker Node Security Configuration\n",
      "[INFO] 4.1 Worker Node Configuration Files\n",
      "[PASS] 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated)\n",
      "[PASS] 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)\n",
      "[PASS] 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Manual)\n",
      "[PASS] 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "[PASS] 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Manual)\n",
      "[WARN] 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)\n",
      "[WARN] 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual)\n",
      "[PASS] 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)\n",
      "[PASS] 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated)\n",
      "[INFO] 4.2 Kubelet\n",
      "[PASS] 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated)\n",
      "[PASS] 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)\n",
      "[PASS] 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)\n",
      "[PASS] 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual)\n",
      "[PASS] 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)\n",
      "[FAIL] 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)\n",
      "[PASS] 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)\n",
      "[WARN] 4.2.8 Ensure that the --hostname-override argument is not set (Manual)\n",
      "[WARN] 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)\n",
      "[WARN] 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)\n",
      "[PASS] 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual)\n",
      "[PASS] 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)\n",
      "[WARN] 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)\n",
      "\n",
      "== Remediations node ==\n",
      "4.1.7 Run the following command to modify the file permissions of the\n",
      "--client-ca-file chmod 644 <filename>\n",
      "\n",
      "4.1.8 Run the following command to modify the ownership of the --client-ca-file.\n",
      "chown root:root <filename>\n",
      "\n",
      "4.2.6 If using a Kubelet config file, edit the file to set protectKernelDefaults: true.\n",
      "If using command line arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n",
      "--protect-kernel-defaults=true\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.8 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n",
      "on each worker node and remove the --hostname-override argument from the\n",
      "KUBELET_SYSTEM_PODS_ARGS variable.\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.9 If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.\n",
      "If using command line arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.10 If using a Kubelet config file, edit the file to set tlsCertFile to the location\n",
      "of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile\n",
      "to the location of the corresponding private key file.\n",
      "If using command line arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the below parameters in KUBELET_CERTIFICATE_ARGS variable.\n",
      "--tls-cert-file=<path/to/tls-certificate-file>\n",
      "--tls-private-key-file=<path/to/tls-key-file>\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.13 If using a Kubelet config file, edit the file to set TLSCipherSuites: to\n",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\n",
      "or to a subset of these values.\n",
      "If using executable arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the --tls-cipher-suites parameter as follows, or to a subset of these values.\n",
      "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "\n",
      "== Summary node ==\n",
      "16 checks PASS\n",
      "1 checks FAIL\n",
      "6 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "[INFO] 5 Kubernetes Policies\n",
      "[INFO] 5.1 RBAC and Service Accounts\n",
      "[WARN] 5.1.1 Ensure that the cluster-admin role is only used where required (Manual)\n",
      "[WARN] 5.1.2 Minimize access to secrets (Manual)\n",
      "[WARN] 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)\n",
      "[WARN] 5.1.4 Minimize access to create pods (Manual)\n",
      "[WARN] 5.1.5 Ensure that default service accounts are not actively used. (Manual)\n",
      "[WARN] 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)\n",
      "[INFO] 5.2 Pod Security Policies\n",
      "[WARN] 5.2.1 Minimize the admission of privileged containers (Manual)\n",
      "[WARN] 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Manual)\n",
      "[WARN] 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Manual)\n",
      "[WARN] 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Manual)\n",
      "[WARN] 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Manual)\n",
      "[WARN] 5.2.6 Minimize the admission of root containers (Manual)\n",
      "[WARN] 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual)\n",
      "[WARN] 5.2.8 Minimize the admission of containers with added capabilities (Manual)\n",
      "[WARN] 5.2.9 Minimize the admission of containers with capabilities assigned (Manual)\n",
      "[INFO] 5.3 Network Policies and CNI\n",
      "[WARN] 5.3.1 Ensure that the CNI in use supports Network Policies (Manual)\n",
      "[WARN] 5.3.2 Ensure that all Namespaces have Network Policies defined (Manual)\n",
      "[INFO] 5.4 Secrets Management\n",
      "[WARN] 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual)\n",
      "[WARN] 5.4.2 Consider external secret storage (Manual)\n",
      "[INFO] 5.5 Extensible Admission Control\n",
      "[WARN] 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)\n",
      "[INFO] 5.7 General Policies\n",
      "[WARN] 5.7.1 Create administrative boundaries between resources using namespaces (Manual)\n",
      "[WARN] 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)\n",
      "[WARN] 5.7.3 Apply Security Context to Your Pods and Containers (Manual)\n",
      "[WARN] 5.7.4 The default namespace should not be used (Manual)\n",
      "\n",
      "== Remediations policies ==\n",
      "5.1.1 Identify all clusterrolebindings to the cluster-admin role. Check if they are used and\n",
      "if they need this role or if they could use a role with fewer privileges.\n",
      "Where possible, first bind users to a lower privileged role and then remove the\n",
      "clusterrolebinding to the cluster-admin role :\n",
      "kubectl delete clusterrolebinding [name]\n",
      "\n",
      "5.1.2 Where possible, remove get, list and watch access to secret objects in the cluster.\n",
      "\n",
      "5.1.3 Where possible replace any use of wildcards in clusterroles and roles with specific\n",
      "objects or actions.\n",
      "\n",
      "5.1.4 Where possible, remove create access to pod objects in the cluster.\n",
      "\n",
      "5.1.5 Create explicit service accounts wherever a Kubernetes workload requires specific access\n",
      "to the Kubernetes API server.\n",
      "Modify the configuration of each default service account to include this value\n",
      "automountServiceAccountToken: false\n",
      "\n",
      "5.1.6 Modify the definition of pods and service accounts which do not need to mount service\n",
      "account tokens to disable it.\n",
      "\n",
      "5.2.1 Create a PSP as described in the Kubernetes documentation, ensuring that\n",
      "the .spec.privileged field is omitted or set to false.\n",
      "\n",
      "5.2.2 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.hostPID field is omitted or set to false.\n",
      "\n",
      "5.2.3 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.hostIPC field is omitted or set to false.\n",
      "\n",
      "5.2.4 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.hostNetwork field is omitted or set to false.\n",
      "\n",
      "5.2.5 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.allowPrivilegeEscalation field is omitted or set to false.\n",
      "\n",
      "5.2.6 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of\n",
      "UIDs not including 0.\n",
      "\n",
      "5.2.7 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.requiredDropCapabilities is set to include either NET_RAW or ALL.\n",
      "\n",
      "5.2.8 Ensure that allowedCapabilities is not present in PSPs for the cluster unless\n",
      "it is set to an empty array.\n",
      "\n",
      "5.2.9 Review the use of capabilites in applications running on your cluster. Where a namespace\n",
      "contains applicaions which do not require any Linux capabities to operate consider adding\n",
      "a PSP which forbids the admission of containers which do not drop all capabilities.\n",
      "\n",
      "5.3.1 If the CNI plugin in use does not support network policies, consideration should be given to\n",
      "making use of a different plugin, or finding an alternate mechanism for restricting traffic\n",
      "in the Kubernetes cluster.\n",
      "\n",
      "5.3.2 Follow the documentation and create NetworkPolicy objects as you need them.\n",
      "\n",
      "5.4.1 if possible, rewrite application code to read secrets from mounted secret files, rather than\n",
      "from environment variables.\n",
      "\n",
      "5.4.2 Refer to the secrets management options offered by your cloud provider or a third-party\n",
      "secrets management solution.\n",
      "\n",
      "5.5.1 Follow the Kubernetes documentation and setup image provenance.\n",
      "\n",
      "5.7.1 Follow the documentation and create namespaces for objects in your deployment as you need\n",
      "them.\n",
      "\n",
      "5.7.2 Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you\n",
      "would need to enable alpha features in the apiserver by passing \"--feature-\n",
      "gates=AllAlpha=true\" argument.\n",
      "Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS\n",
      "parameter to \"--feature-gates=AllAlpha=true\"\n",
      "KUBE_API_ARGS=\"--feature-gates=AllAlpha=true\"\n",
      "Based on your system, restart the kube-apiserver service. For example:\n",
      "systemctl restart kube-apiserver.service\n",
      "Use annotations to enable the docker/default seccomp profile in your pod definitions. An\n",
      "example is as below:\n",
      "apiVersion: v1\n",
      "kind: Pod\n",
      "metadata:\n",
      "  name: trustworthy-pod\n",
      "  annotations:\n",
      "    seccomp.security.alpha.kubernetes.io/pod: docker/default\n",
      "spec:\n",
      "  containers:\n",
      "    - name: trustworthy-container\n",
      "      image: sotrustworthy:latest\n",
      "\n",
      "5.7.3 Follow the Kubernetes documentation and apply security contexts to your pods. For a\n",
      "suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker\n",
      "Containers.\n",
      "\n",
      "5.7.4 Ensure that namespaces are created to allow for appropriate segregation of Kubernetes\n",
      "resources and that all new resources are created in a specific namespace.\n",
      "\n",
      "\n",
      "== Summary policies ==\n",
      "0 checks PASS\n",
      "0 checks FAIL\n",
      "24 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "== Summary total ==\n",
      "62 checks PASS\n",
      "14 checks FAIL\n",
      "46 checks WARN\n",
      "0 checks INFO\n",
      "\n"
     ]
    }
   ],
   "source": [
    "kubectl logs kube-bench--1-cqzmb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "ca57af25",
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[34m[INFO] \u001b[0m1 Master Node Security Configuration\n",
      "\u001b[34m[INFO] \u001b[0m1.1 Master Node Configuration Files\n",
      "\u001b[32m[PASS] \u001b[0m1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m1.2 API Server\n",
      "\u001b[33m[WARN] \u001b[0m1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.3 Ensure that the --kubelet-https argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.15 Ensure that the admission control plugin PodSecurityPolicy is set (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.17 Ensure that the --insecure-bind-address argument is not set (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.18 Ensure that the --insecure-port argument is set to 0 (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.19 Ensure that the --secure-port argument is not set to 0 (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.20 Ensure that the --profiling argument is set to false (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.21 Ensure that the --audit-log-path argument is set (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.22 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.23 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)\n",
      "\u001b[31m[FAIL] \u001b[0m1.2.24 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.25 Ensure that the --request-timeout argument is set as appropriate (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.26 Ensure that the --service-account-lookup argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.27 Ensure that the --service-account-key-file argument is set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.28 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.29 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.30 Ensure that the --client-ca-file argument is set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.2.31 Ensure that the --etcd-cafile argument is set as appropriate (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.32 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.33 Ensure that encryption providers are appropriately configured (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m1.2.34 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m1.3 Controller Manager\n",
      "\u001b[33m[WARN] \u001b[0m1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)\n",
      "\u001b[31m[FAIL] \u001b[0m1.3.2 Ensure that the --profiling argument is set to false (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)\n",
      "\u001b[34m[INFO] \u001b[0m1.4 Scheduler\n",
      "\u001b[31m[FAIL] \u001b[0m1.4.1 Ensure that the --profiling argument is set to false (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)\n",
      "\n",
      "\u001b[33m== Remediations master ==\n",
      "\u001b[0m1.1.9 Run the below command (based on the file location on your system) on the master node.\n",
      "For example,\n",
      "chmod 644 <path/to/cni/files>\n",
      "\n",
      "1.1.10 Run the below command (based on the file location on your system) on the master node.\n",
      "For example,\n",
      "chown root:root <path/to/cni/files>\n",
      "\n",
      "1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\n",
      "from the below command:\n",
      "ps -ef | grep etcd\n",
      "Run the below command (based on the etcd data directory found above).\n",
      "For example, chown etcd:etcd /var/lib/etcd\n",
      "\n",
      "1.1.19 Run the below command (based on the file location on your system) on the master node.\n",
      "For example,\n",
      "chown -R root:root /etc/kubernetes/pki/\n",
      "\n",
      "1.1.20 audit test did not run: failed to run: \"find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a\", output: \"find: ‘/etc/kubernetes/pki/’: No such file or directory\\nstat: missing operand\\nTry 'stat --help' for more information.\\n\", error: exit status 123\n",
      "1.1.21 audit test did not run: failed to run: \"find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a\", output: \"find: ‘/etc/kubernetes/pki/’: No such file or directory\\nstat: missing operand\\nTry 'stat --help' for more information.\\n\", error: exit status 123\n",
      "1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--anonymous-auth=false\n",
      "\n",
      "1.2.5 Follow the Kubernetes documentation and setup the TLS connection between\n",
      "the apiserver and kubelets. Then, edit the API server pod specification file\n",
      "/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the\n",
      "--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.\n",
      "--kubelet-certificate-authority=<ca-string>\n",
      "\n",
      "1.2.9 Follow the Kubernetes documentation and set the desired limits in a configuration file.\n",
      "Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "and set the below parameters.\n",
      "--enable-admission-plugins=...,EventRateLimit,...\n",
      "--admission-control-config-file=<path/to/configuration/file>\n",
      "\n",
      "1.2.11 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --enable-admission-plugins parameter to include\n",
      "AlwaysPullImages.\n",
      "--enable-admission-plugins=...,AlwaysPullImages,...\n",
      "\n",
      "1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --enable-admission-plugins parameter to include\n",
      "SecurityContextDeny, unless PodSecurityPolicy is already in place.\n",
      "--enable-admission-plugins=...,SecurityContextDeny,...\n",
      "\n",
      "1.2.15 Follow the documentation and create Pod Security Policy objects as per your environment.\n",
      "Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --enable-admission-plugins parameter to a\n",
      "value that includes PodSecurityPolicy:\n",
      "--enable-admission-plugins=...,PodSecurityPolicy,...\n",
      "Then restart the API Server.\n",
      "\n",
      "1.2.18 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--insecure-port=0\n",
      "\n",
      "1.2.20 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--profiling=false\n",
      "\n",
      "1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-path parameter to a suitable path and\n",
      "file where you would like audit logs to be written, for example:\n",
      "--audit-log-path=/var/log/apiserver/audit.log\n",
      "\n",
      "1.2.22 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days:\n",
      "--audit-log-maxage=30\n",
      "\n",
      "1.2.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate\n",
      "value.\n",
      "--audit-log-maxbackup=10\n",
      "\n",
      "1.2.24 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB.\n",
      "For example, to set it as 100 MB:\n",
      "--audit-log-maxsize=100\n",
      "\n",
      "1.2.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "and set the below parameter as appropriate and if needed.\n",
      "For example,\n",
      "--request-timeout=300s\n",
      "\n",
      "1.2.32 Follow the Kubernetes documentation and configure a EncryptionConfig file.\n",
      "Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>\n",
      "\n",
      "1.2.33 Follow the Kubernetes documentation and configure a EncryptionConfig file.\n",
      "In this file, choose aescbc, kms or secretbox as the encryption provider.\n",
      "\n",
      "1.2.34 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "on the master node and set the below parameter.\n",
      "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n",
      "_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n",
      "_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n",
      "_SHA384\n",
      "\n",
      "1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\n",
      "on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold,\n",
      "for example:\n",
      "--terminated-pod-gc-threshold=10\n",
      "\n",
      "1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\n",
      "on the master node and set the below parameter.\n",
      "--profiling=false\n",
      "\n",
      "1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file\n",
      "on the master node and set the below parameter.\n",
      "--profiling=false\n",
      "\n",
      "\n",
      "\u001b[31m== Summary master ==\n",
      "\u001b[0m39 checks PASS\n",
      "12 checks FAIL\n",
      "13 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m2 Etcd Node Configuration\n",
      "\u001b[34m[INFO] \u001b[0m2 Etcd Node Configuration Files\n",
      "\u001b[32m[PASS] \u001b[0m2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m2.2 Ensure that the --client-cert-auth argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m2.3 Ensure that the --auto-tls argument is not set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)\n",
      "\n",
      "\u001b[32m== Summary etcd ==\n",
      "\u001b[0m7 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m3 Control Plane Configuration\n",
      "\u001b[34m[INFO] \u001b[0m3.1 Authentication and Authorization\n",
      "\u001b[33m[WARN] \u001b[0m3.1.1 Client certificate authentication should not be used for users (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m3.2 Logging\n",
      "\u001b[33m[WARN] \u001b[0m3.2.1 Ensure that a minimal audit policy is created (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m3.2.2 Ensure that the audit policy covers key security concerns (Manual)\n",
      "\n",
      "\u001b[33m== Remediations controlplane ==\n",
      "\u001b[0m3.1.1 Alternative mechanisms provided by Kubernetes such as the use of OIDC should be\n",
      "implemented in place of client certificates.\n",
      "\n",
      "3.2.1 Create an audit policy file for your cluster.\n",
      "\n",
      "3.2.2 Consider modification of the audit policy in use on the cluster to include these items, at a\n",
      "minimum.\n",
      "\n",
      "\n",
      "\u001b[33m== Summary controlplane ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "3 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m4 Worker Node Security Configuration\n",
      "\u001b[34m[INFO] \u001b[0m4.1 Worker Node Configuration Files\n",
      "\u001b[32m[PASS] \u001b[0m4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated)\n",
      "\u001b[34m[INFO] \u001b[0m4.2 Kubelet\n",
      "\u001b[32m[PASS] \u001b[0m4.2.1 Ensure that the anonymous-auth argument is set to false (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)\n",
      "\u001b[31m[FAIL] \u001b[0m4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m4.2.8 Ensure that the --hostname-override argument is not set (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual)\n",
      "\u001b[32m[PASS] \u001b[0m4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)\n",
      "\n",
      "\u001b[33m== Remediations node ==\n",
      "\u001b[0m4.1.7 Run the following command to modify the file permissions of the\n",
      "--client-ca-file chmod 644 <filename>\n",
      "\n",
      "4.1.8 Run the following command to modify the ownership of the --client-ca-file.\n",
      "chown root:root <filename>\n",
      "\n",
      "4.2.6 If using a Kubelet config file, edit the file to set protectKernelDefaults: true.\n",
      "If using command line arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n",
      "--protect-kernel-defaults=true\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.8 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n",
      "on each worker node and remove the --hostname-override argument from the\n",
      "KUBELET_SYSTEM_PODS_ARGS variable.\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.9 If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.\n",
      "If using command line arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.10 If using a Kubelet config file, edit the file to set tlsCertFile to the location\n",
      "of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile\n",
      "to the location of the corresponding private key file.\n",
      "If using command line arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the below parameters in KUBELET_CERTIFICATE_ARGS variable.\n",
      "--tls-cert-file=<path/to/tls-certificate-file>\n",
      "--tls-private-key-file=<path/to/tls-key-file>\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "4.2.13 If using a Kubelet config file, edit the file to set TLSCipherSuites: to\n",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\n",
      "or to a subset of these values.\n",
      "If using executable arguments, edit the kubelet service file\n",
      "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\n",
      "set the --tls-cipher-suites parameter as follows, or to a subset of these values.\n",
      "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\n",
      "Based on your system, restart the kubelet service. For example:\n",
      "systemctl daemon-reload\n",
      "systemctl restart kubelet.service\n",
      "\n",
      "\n",
      "\u001b[31m== Summary node ==\n",
      "\u001b[0m16 checks PASS\n",
      "1 checks FAIL\n",
      "6 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m5 Kubernetes Policies\n",
      "\u001b[34m[INFO] \u001b[0m5.1 RBAC and Service Accounts\n",
      "\u001b[33m[WARN] \u001b[0m5.1.1 Ensure that the cluster-admin role is only used where required (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.2 Minimize access to secrets (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.4 Minimize access to create pods (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.5 Ensure that default service accounts are not actively used. (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.7 Avoid use of system:masters group (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m5.2 Pod Security Policies\n",
      "\u001b[33m[WARN] \u001b[0m5.2.1 Minimize the admission of privileged containers (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.6 Minimize the admission of root containers (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.7 Minimize the admission of containers with the NET_RAW capability (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.8 Minimize the admission of containers with added capabilities (Automated)\n",
      "\u001b[33m[WARN] \u001b[0m5.2.9 Minimize the admission of containers with capabilities assigned (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m5.3 Network Policies and CNI\n",
      "\u001b[33m[WARN] \u001b[0m5.3.1 Ensure that the CNI in use supports Network Policies (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.3.2 Ensure that all Namespaces have Network Policies defined (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m5.4 Secrets Management\n",
      "\u001b[33m[WARN] \u001b[0m5.4.1 Prefer using secrets as files over secrets as environment variables (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.4.2 Consider external secret storage (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m5.5 Extensible Admission Control\n",
      "\u001b[33m[WARN] \u001b[0m5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)\n",
      "\u001b[34m[INFO] \u001b[0m5.7 General Policies\n",
      "\u001b[33m[WARN] \u001b[0m5.7.1 Create administrative boundaries between resources using namespaces (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.7.3 Apply Security Context to Your Pods and Containers (Manual)\n",
      "\u001b[33m[WARN] \u001b[0m5.7.4 The default namespace should not be used (Manual)\n",
      "\n",
      "\u001b[33m== Remediations policies ==\n",
      "\u001b[0m5.1.1 Identify all clusterrolebindings to the cluster-admin role. Check if they are used and\n",
      "if they need this role or if they could use a role with fewer privileges.\n",
      "Where possible, first bind users to a lower privileged role and then remove the\n",
      "clusterrolebinding to the cluster-admin role :\n",
      "kubectl delete clusterrolebinding [name]\n",
      "\n",
      "5.1.2 Where possible, remove get, list and watch access to secret objects in the cluster.\n",
      "\n",
      "5.1.3 Where possible replace any use of wildcards in clusterroles and roles with specific\n",
      "objects or actions.\n",
      "\n",
      "5.1.4 Where possible, remove create access to pod objects in the cluster.\n",
      "\n",
      "5.1.5 Create explicit service accounts wherever a Kubernetes workload requires specific access\n",
      "to the Kubernetes API server.\n",
      "Modify the configuration of each default service account to include this value\n",
      "automountServiceAccountToken: false\n",
      "\n",
      "5.1.6 Modify the definition of pods and service accounts which do not need to mount service\n",
      "account tokens to disable it.\n",
      "\n",
      "5.1.7 Remove the system:masters group from all users in the cluster.\n",
      "\n",
      "5.1.8 Where possible, remove the impersonate, bind and escalate rights from subjects.\n",
      "\n",
      "5.2.1 Create a PSP as described in the Kubernetes documentation, ensuring that\n",
      "the .spec.privileged field is omitted or set to false.\n",
      "\n",
      "5.2.2 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.hostPID field is omitted or set to false.\n",
      "\n",
      "5.2.3 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.hostIPC field is omitted or set to false.\n",
      "\n",
      "5.2.4 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.hostNetwork field is omitted or set to false.\n",
      "\n",
      "5.2.5 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.allowPrivilegeEscalation field is omitted or set to false.\n",
      "\n",
      "5.2.6 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of\n",
      "UIDs not including 0.\n",
      "\n",
      "5.2.7 Create a PSP as described in the Kubernetes documentation, ensuring that the\n",
      ".spec.requiredDropCapabilities is set to include either NET_RAW or ALL.\n",
      "\n",
      "5.2.8 Ensure that allowedCapabilities is not present in PSPs for the cluster unless\n",
      "it is set to an empty array.\n",
      "\n",
      "5.2.9 Review the use of capabilites in applications running on your cluster. Where a namespace\n",
      "contains applicaions which do not require any Linux capabities to operate consider adding\n",
      "a PSP which forbids the admission of containers which do not drop all capabilities.\n",
      "\n",
      "5.3.1 If the CNI plugin in use does not support network policies, consideration should be given to\n",
      "making use of a different plugin, or finding an alternate mechanism for restricting traffic\n",
      "in the Kubernetes cluster.\n",
      "\n",
      "5.3.2 Follow the documentation and create NetworkPolicy objects as you need them.\n",
      "\n",
      "5.4.1 if possible, rewrite application code to read secrets from mounted secret files, rather than\n",
      "from environment variables.\n",
      "\n",
      "5.4.2 Refer to the secrets management options offered by your cloud provider or a third-party\n",
      "secrets management solution.\n",
      "\n",
      "5.5.1 Follow the Kubernetes documentation and setup image provenance.\n",
      "\n",
      "5.7.1 Follow the documentation and create namespaces for objects in your deployment as you need\n",
      "them.\n",
      "\n",
      "5.7.2 Use security context to enable the docker/default seccomp profile in your pod definitions.\n",
      "An example is as below:\n",
      "  securityContext:\n",
      "    seccompProfile:\n",
      "      type: RuntimeDefault\n",
      "\n",
      "5.7.3 Follow the Kubernetes documentation and apply security contexts to your pods. For a\n",
      "suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker\n",
      "Containers.\n",
      "\n",
      "5.7.4 Ensure that namespaces are created to allow for appropriate segregation of Kubernetes\n",
      "resources and that all new resources are created in a specific namespace.\n",
      "\n",
      "\n",
      "\u001b[33m== Summary policies ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "26 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[31m== Summary total ==\n",
      "\u001b[0m62 checks PASS\n",
      "13 checks FAIL\n",
      "48 checks WARN\n",
      "0 checks INFO\n",
      "\n"
     ]
    }
   ],
   "source": [
    "kube-bench"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "eff590a5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "This tool runs the CIS Kubernetes Benchmark (https://www.cisecurity.org/benchmark/kubernetes/)\n",
      "\n",
      "Usage:\n",
      "  kube-bench [flags]\n",
      "  kube-bench [command]\n",
      "\n",
      "Available Commands:\n",
      "  completion  Generate the autocompletion script for the specified shell\n",
      "  help        Help about any command\n",
      "  run         Run tests\n",
      "  version     Shows the version of kube-bench.\n",
      "\n",
      "Flags:\n",
      "      --alsologtostderr                  log to standard error as well as files\n",
      "      --asff                             Send the results to AWS Security Hub\n",
      "      --benchmark string                 Manually specify CIS benchmark version. It would be an error to specify both --version and --benchmark flags\n",
      "  -c, --check string                     A comma-delimited list of checks to run as specified in CIS document. Example --check=\"1.1.1,1.1.2\"\n",
      "      --config string                    config file (default is ./cfg/config.yaml)\n",
      "  -D, --config-dir string                config directory (default \"./cfg/\")\n",
      "      --exit-code int                    Specify the exit code for when checks fail\n",
      "  -g, --group string                     Run all the checks under this comma-delimited list of groups. Example --group=\"1.1\"\n",
      "  -h, --help                             help for kube-bench\n",
      "      --include-test-output              Prints the actual result when test fails\n",
      "      --json                             Prints the results as JSON\n",
      "      --junit                            Prints the results as JUnit\n",
      "      --log_backtrace_at traceLocation   when logging hits line file:N, emit a stack trace (default :0)\n",
      "      --log_dir string                   If non-empty, write log files in this directory\n",
      "      --logtostderr                      log to standard error instead of files (default true)\n",
      "      --noremediations                   Disable printing of remediations section\n",
      "      --noresults                        Disable printing of results section\n",
      "      --nosummary                        Disable printing of summary section\n",
      "      --nototals                         Disable printing of totals for failed, passed, ... checks across all sections\n",
      "      --outputfile string                Writes the JSON results to output file\n",
      "      --pgsql                            Save the results to PostgreSQL\n",
      "      --scored                           Run the scored CIS checks (default true)\n",
      "      --skip string                      List of comma separated values of checks to be skipped\n",
      "      --stderrthreshold severity         logs at or above this threshold go to stderr (default 2)\n",
      "      --unscored                         Run the unscored CIS checks (default true)\n",
      "  -v, --v Level                          log level for V logs\n",
      "      --version string                   Manually specify Kubernetes version, automatically detected if unset\n",
      "      --vmodule moduleSpec               comma-separated list of pattern=N settings for file-filtered logging\n",
      "\n",
      "Use \"kube-bench [command] --help\" for more information about a command.\n"
     ]
    }
   ],
   "source": [
    "kube-bench --help"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "93a248c8",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CONTRIBUTING.md  cfg            go.mod       job-ack.yaml       job-master.yaml\n",
      "Dockerfile       check          go.sum       job-aks.yaml       job-node.yaml\n",
      "LICENSE          cmd            hack         job-eks-asff.yaml  job.yaml\n",
      "NOTICE           codecov.yml    hooks        job-eks.yaml       main.go\n",
      "OWNERS           docs           integration  job-gke.yaml       makefile\n",
      "README.md        entrypoint.sh  internal     job-iks.yaml       mkdocs.yml\n"
     ]
    }
   ],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "3f03d46c-9307-44af-885d-21efb0bdd074",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ack-1.0  cis-1.20  cis-1.6      eks-1.0.1  gke-1.2.0  rh-1.0\n",
      "aks-1.0  cis-1.5   config.yaml  gke-1.0    rh-0.7\n"
     ]
    }
   ],
   "source": [
    "ls cfg"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "bbf778a9-aa23-4ab6-b969-b85971fe3e5a",
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "---\n",
      "## Controls Files.\n",
      "# These are YAML files that hold all the details for running checks.\n",
      "#\n",
      "## Uncomment to use different control file paths.\n",
      "# masterControls: ./cfg/master.yaml\n",
      "# nodeControls: ./cfg/node.yaml\n",
      "\n",
      "master:\n",
      "  components:\n",
      "    - apiserver\n",
      "    - scheduler\n",
      "    - controllermanager\n",
      "    - etcd\n",
      "    - flanneld\n",
      "    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark\n",
      "    - kubernetes\n",
      "    - kubelet\n",
      "\n",
      "  kubernetes:\n",
      "    defaultconf: /etc/kubernetes/config\n",
      "\n",
      "  apiserver:\n",
      "    bins:\n",
      "      - \"kube-apiserver\"\n",
      "      - \"hyperkube apiserver\"\n",
      "      - \"hyperkube kube-apiserver\"\n",
      "      - \"apiserver\"\n",
      "      - \"openshift start master api\"\n",
      "      - \"hypershift openshift-kube-apiserver\"\n",
      "    confs:\n",
      "      - /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "      - /etc/kubernetes/manifests/kube-apiserver.yml\n",
      "      - /etc/kubernetes/manifests/kube-apiserver.manifest\n",
      "      - /var/snap/kube-apiserver/current/args\n",
      "      - /var/snap/microk8s/current/args/kube-apiserver\n",
      "      - /etc/origin/master/master-config.yaml\n",
      "      - /etc/kubernetes/manifests/talos-kube-apiserver.yaml\n",
      "    defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml\n",
      "\n",
      "  scheduler:\n",
      "    bins:\n",
      "      - \"kube-scheduler\"\n",
      "      - \"hyperkube scheduler\"\n",
      "      - \"hyperkube kube-scheduler\"\n",
      "      - \"scheduler\"\n",
      "      - \"openshift start master controllers\"\n",
      "    confs:\n",
      "      - /etc/kubernetes/manifests/kube-scheduler.yaml\n",
      "      - /etc/kubernetes/manifests/kube-scheduler.yml\n",
      "      - /etc/kubernetes/manifests/kube-scheduler.manifest\n",
      "      - /var/snap/kube-scheduler/current/args\n",
      "      - /var/snap/microk8s/current/args/kube-scheduler\n",
      "      - /etc/origin/master/scheduler.json\n",
      "      - /etc/kubernetes/manifests/talos-kube-scheduler.yaml\n",
      "    defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml\n",
      "    kubeconfig:\n",
      "      - /etc/kubernetes/scheduler.conf\n",
      "      - /var/lib/kube-scheduler/kubeconfig\n",
      "      - /var/lib/kube-scheduler/config.yaml\n",
      "      - /system/secrets/kubernetes/kube-scheduler/kubeconfig\n",
      "    defaultkubeconfig: /etc/kubernetes/scheduler.conf\n",
      "\n",
      "  controllermanager:\n",
      "    bins:\n",
      "      - \"kube-controller-manager\"\n",
      "      - \"kube-controller\"\n",
      "      - \"hyperkube controller-manager\"\n",
      "      - \"hyperkube kube-controller-manager\"\n",
      "      - \"controller-manager\"\n",
      "      - \"openshift start master controllers\"\n",
      "      - \"hypershift openshift-controller-manager\"\n",
      "    confs:\n",
      "      - /etc/kubernetes/manifests/kube-controller-manager.yaml\n",
      "      - /etc/kubernetes/manifests/kube-controller-manager.yml\n",
      "      - /etc/kubernetes/manifests/kube-controller-manager.manifest\n",
      "      - /var/snap/kube-controller-manager/current/args\n",
      "      - /var/snap/microk8s/current/args/kube-controller-manager\n",
      "      - /etc/kubernetes/manifests/talos-kube-controller-manager.yaml\n",
      "    defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml\n",
      "    kubeconfig:\n",
      "      - /etc/kubernetes/controller-manager.conf\n",
      "      - /var/lib/kube-controller-manager/kubeconfig\n",
      "      - /system/secrets/kubernetes/kube-controller-manager/kubeconfig\n",
      "    defaultkubeconfig: /etc/kubernetes/controller-manager.conf\n",
      "\n",
      "  etcd:\n",
      "    optional: true\n",
      "    bins:\n",
      "      - \"etcd\"\n",
      "      - \"openshift start etcd\"\n",
      "    confs:\n",
      "      - /etc/kubernetes/manifests/etcd.yaml\n",
      "      - /etc/kubernetes/manifests/etcd.yml\n",
      "      - /etc/kubernetes/manifests/etcd.manifest\n",
      "      - /etc/etcd/etcd.conf\n",
      "      - /var/snap/etcd/common/etcd.conf.yml\n",
      "      - /var/snap/etcd/common/etcd.conf.yaml\n",
      "      - /var/snap/microk8s/current/args/etcd\n",
      "      - /usr/lib/systemd/system/etcd.service\n",
      "    defaultconf: /etc/kubernetes/manifests/etcd.yaml\n",
      "\n",
      "  flanneld:\n",
      "    optional: true\n",
      "    bins:\n",
      "      - flanneld\n",
      "    defaultconf: /etc/sysconfig/flanneld\n",
      "\n",
      "  kubelet:\n",
      "    optional: true\n",
      "    bins:\n",
      "      - \"hyperkube kubelet\"\n",
      "      - \"kubelet\"\n",
      "\n",
      "node:\n",
      "  components:\n",
      "    - kubelet\n",
      "    - proxy\n",
      "    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark\n",
      "    - kubernetes\n",
      "\n",
      "  kubernetes:\n",
      "    defaultconf: \"/etc/kubernetes/config\"\n",
      "\n",
      "  kubelet:\n",
      "    cafile:\n",
      "      - \"/etc/kubernetes/pki/ca.crt\"\n",
      "      - \"/etc/kubernetes/certs/ca.crt\"\n",
      "      - \"/etc/kubernetes/cert/ca.pem\"\n",
      "      - \"/var/snap/microk8s/current/certs/ca.crt\"\n",
      "    svc:\n",
      "      # These paths must also be included\n",
      "      #  in the 'confs' property below\n",
      "      - \"/etc/systemd/system/kubelet.service.d/10-kubeadm.conf\"\n",
      "      - \"/etc/systemd/system/kubelet.service\"\n",
      "      - \"/lib/systemd/system/kubelet.service\"\n",
      "      - \"/etc/systemd/system/snap.kubelet.daemon.service\"\n",
      "      - \"/etc/systemd/system/snap.microk8s.daemon-kubelet.service\"\n",
      "      - \"/etc/systemd/system/atomic-openshift-node.service\"\n",
      "      - \"/etc/systemd/system/origin-node.service\"\n",
      "    bins:\n",
      "      - \"hyperkube kubelet\"\n",
      "      - \"kubelet\"\n",
      "    kubeconfig:\n",
      "      - \"/etc/kubernetes/kubelet.conf\"\n",
      "      - \"/etc/kubernetes/kubelet-kubeconfig.conf\"\n",
      "      - \"/var/lib/kubelet/kubeconfig\"\n",
      "      - \"/etc/kubernetes/kubelet-kubeconfig\"\n",
      "      - \"/etc/kubernetes/kubelet/kubeconfig\"\n",
      "      - \"/var/snap/microk8s/current/credentials/kubelet.config\"\n",
      "      - \"/etc/kubernetes/kubeconfig-kubelet\"\n",
      "    confs:\n",
      "      - \"/etc/kubernetes/kubelet-config.yaml\"\n",
      "      - \"/var/lib/kubelet/config.yaml\"\n",
      "      - \"/var/lib/kubelet/config.yml\"\n",
      "      - \"/etc/kubernetes/kubelet/kubelet-config.json\"\n",
      "      - \"/etc/kubernetes/kubelet/config\"\n",
      "      - \"/home/kubernetes/kubelet-config.yaml\"\n",
      "      - \"/home/kubernetes/kubelet-config.yml\"\n",
      "      - \"/etc/default/kubeletconfig.json\"\n",
      "      - \"/etc/default/kubelet\"\n",
      "      - \"/var/lib/kubelet/kubeconfig\"\n",
      "      - \"/var/snap/kubelet/current/args\"\n",
      "      - \"/var/snap/microk8s/current/args/kubelet\"\n",
      "      ## Due to the fact that the kubelet might be configured\n",
      "      ## without a kubelet-config file, we use a work-around\n",
      "      ## of pointing to the systemd service file (which can also\n",
      "      ## hold kubelet configuration).\n",
      "      ## Note: The following paths must match the one under 'svc'\n",
      "      - \"/etc/systemd/system/kubelet.service.d/10-kubeadm.conf\"\n",
      "      - \"/etc/systemd/system/kubelet.service\"\n",
      "      - \"/lib/systemd/system/kubelet.service\"\n",
      "      - \"/etc/systemd/system/snap.kubelet.daemon.service\"\n",
      "      - \"/etc/systemd/system/snap.microk8s.daemon-kubelet.service\"\n",
      "      - \"/etc/kubernetes/kubelet.yaml\"\n",
      "    defaultconf: \"/var/lib/kubelet/config.yaml\"\n",
      "    defaultsvc: \"/etc/systemd/system/kubelet.service.d/10-kubeadm.conf\"\n",
      "    defaultkubeconfig: \"/etc/kubernetes/kubelet.conf\"\n",
      "    defaultcafile: \"/etc/kubernetes/pki/ca.crt\"\n",
      "\n",
      "  proxy:\n",
      "    optional: true\n",
      "    bins:\n",
      "      - \"kube-proxy\"\n",
      "      - \"hyperkube proxy\"\n",
      "      - \"hyperkube kube-proxy\"\n",
      "      - \"proxy\"\n",
      "      - \"openshift start network\"\n",
      "    confs:\n",
      "      - /etc/kubernetes/proxy\n",
      "      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml\n",
      "      - /etc/kubernetes/addons/kube-proxy-daemonset.yml\n",
      "      - /var/snap/kube-proxy/current/args\n",
      "      - /var/snap/microk8s/current/args/kube-proxy\n",
      "    kubeconfig:\n",
      "      - \"/etc/kubernetes/kubelet-kubeconfig\"\n",
      "      - \"/etc/kubernetes/kubelet-kubeconfig.conf\"\n",
      "      - \"/etc/kubernetes/kubelet/config\"\n",
      "      - \"/var/lib/kubelet/kubeconfig\"\n",
      "      - \"/var/snap/microk8s/current/credentials/proxy.config\"\n",
      "    svc:\n",
      "      - \"/lib/systemd/system/kube-proxy.service\"\n",
      "      - \"/etc/systemd/system/snap.microk8s.daemon-proxy.service\"\n",
      "    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml\n",
      "    defaultkubeconfig: \"/etc/kubernetes/proxy.conf\"\n",
      "\n",
      "etcd:\n",
      "  components:\n",
      "    - etcd\n",
      "\n",
      "  etcd:\n",
      "    bins:\n",
      "      - \"etcd\"\n",
      "    confs:\n",
      "      - /etc/kubernetes/manifests/etcd.yaml\n",
      "      - /etc/kubernetes/manifests/etcd.yml\n",
      "      - /etc/kubernetes/manifests/etcd.manifest\n",
      "      - /etc/etcd/etcd.conf\n",
      "      - /var/snap/etcd/common/etcd.conf.yml\n",
      "      - /var/snap/etcd/common/etcd.conf.yaml\n",
      "      - /var/snap/microk8s/current/args/etcd\n",
      "      - /usr/lib/systemd/system/etcd.service\n",
      "    defaultconf: /etc/kubernetes/manifests/etcd.yaml\n",
      "\n",
      "controlplane:\n",
      "  components:\n",
      "    - apiserver\n",
      "\n",
      "  apiserver:\n",
      "    bins:\n",
      "      - \"kube-apiserver\"\n",
      "      - \"hyperkube apiserver\"\n",
      "      - \"hyperkube kube-apiserver\"\n",
      "      - \"apiserver\"\n",
      "\n",
      "policies:\n",
      "  components: []\n",
      "\n",
      "managedservices:\n",
      "  components: []\n",
      "\n",
      "version_mapping:\n",
      "  \"1.15\": \"cis-1.5\"\n",
      "  \"1.16\": \"cis-1.6\"\n",
      "  \"1.17\": \"cis-1.6\"\n",
      "  \"1.18\": \"cis-1.6\"\n",
      "  \"1.19\": \"cis-1.20\"\n",
      "  \"1.20\": \"cis-1.20\"\n",
      "  \"eks-1.0.1\": \"eks-1.0.1\"\n",
      "  \"gke-1.0\": \"gke-1.0\"\n",
      "  \"gke-1.2.0\": \"gke-1.2.0\"\n",
      "  \"ocp-3.10\": \"rh-0.7\"\n",
      "  \"ocp-3.11\": \"rh-0.7\"\n",
      "  \"ocp-4.0\": \"rh-1.0\"\n",
      "  \"aks-1.0\": \"aks-1.0\"\n",
      "  \"ack-1.0\": \"ack-1.0\"\n",
      "\n",
      "target_mapping:\n",
      "  \"cis-1.5\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"etcd\"\n",
      "    - \"policies\"\n",
      "  \"cis-1.6\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"etcd\"\n",
      "    - \"policies\"\n",
      "  \"cis-1.20\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"etcd\"\n",
      "    - \"policies\"\n",
      "  \"gke-1.0\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"etcd\"\n",
      "    - \"policies\"\n",
      "    - \"managedservices\"\n",
      "  \"gke-1.2.0\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"policies\"\n",
      "    - \"managedservices\"\n",
      "  \"eks-1.0.1\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"policies\"\n",
      "    - \"managedservices\"\n",
      "  \"rh-0.7\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "  \"aks-1.0\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"policies\"\n",
      "    - \"managedservices\"\n",
      "  \"ack-1.0\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"etcd\"\n",
      "    - \"policies\"\n",
      "    - \"managedservices\"\n",
      "  \"rh-1.0\":\n",
      "    - \"master\"\n",
      "    - \"node\"\n",
      "    - \"controlplane\"\n",
      "    - \"policies\"\n",
      "    - \"etcd\"\n"
     ]
    }
   ],
   "source": [
    "cat cfg/config.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "4ce4f118-8417-43c4-a648-b751366eb502",
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[34m[INFO] \u001b[0m1 Master Node Security Configuration\n",
      "\n",
      "\u001b[32m== Summary master ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m2 Etcd Node Configuration\n",
      "\n",
      "\u001b[32m== Summary etcd ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m3 Control Plane Configuration\n",
      "\n",
      "\u001b[32m== Summary controlplane ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m4 Worker Node Security Configuration\n",
      "\n",
      "\u001b[32m== Summary node ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[34m[INFO] \u001b[0m5 Kubernetes Policies\n",
      "\n",
      "\u001b[32m== Summary policies ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n",
      "\u001b[32m== Summary total ==\n",
      "\u001b[0m0 checks PASS\n",
      "0 checks FAIL\n",
      "0 checks WARN\n",
      "0 checks INFO\n",
      "\n"
     ]
    }
   ],
   "source": [
    "kube-bench run -c cfg/cis-1.20"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "15da864f",
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "---\n",
      "apiVersion: batch/v1\n",
      "kind: Job\n",
      "metadata:\n",
      "  name: kube-bench\n",
      "spec:\n",
      "  template:\n",
      "    spec:\n",
      "      hostPID: true\n",
      "      containers:\n",
      "        - name: kube-bench\n",
      "          image: aquasec/kube-bench:latest\n",
      "          command: [\"kube-bench\", \"run\", \"--targets\", \"node\", \"--benchmark\", \"aks-1.0\"]\n",
      "          volumeMounts:\n",
      "            - name: var-lib-kubelet\n",
      "              mountPath: /var/lib/kubelet\n",
      "              readOnly: true\n",
      "            - name: etc-systemd\n",
      "              mountPath: /etc/systemd\n",
      "              readOnly: true\n",
      "            - name: etc-default\n",
      "              mountPath: /etc/default\n",
      "              readOnly: true\n",
      "            - name: etc-kubernetes\n",
      "              mountPath: /etc/kubernetes\n",
      "              readOnly: true\n",
      "      restartPolicy: Never\n",
      "      volumes:\n",
      "        - name: var-lib-kubelet\n",
      "          hostPath:\n",
      "            path: \"/var/lib/kubelet\"\n",
      "        - name: etc-systemd\n",
      "          hostPath:\n",
      "            path: \"/etc/systemd\"\n",
      "        - name: etc-default\n",
      "          hostPath:\n",
      "            path: \"/etc/default\"\n",
      "        - name: etc-kubernetes\n",
      "          hostPath:\n",
      "            path: \"/etc/kubernetes\"\n"
     ]
    }
   ],
   "source": [
    "cat job-aks.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8cb3ae10-fda3-4b90-adcd-7971cc773d26",
   "metadata": {},
   "outputs": [],
   "source": [
    "cd "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "85c66f9e",
   "metadata": {},
   "outputs": [],
   "source": [
    "git clone https://github.com/kubernetes/kube-state-metrics"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1249152a-9a43-4359-9fe0-b71d2a63a95e",
   "metadata": {},
   "outputs": [],
   "source": [
    "cd kube-state-metrics"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5db22872-0d44-4cfc-a662-344167b5a228",
   "metadata": {},
   "outputs": [],
   "source": [
    "make"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f5cbb684",
   "metadata": {},
   "outputs": [],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3a3f4c2a",
   "metadata": {},
   "outputs": [],
   "source": [
    "go build"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "88b85b03-195b-4211-aece-213e4b082883",
   "metadata": {},
   "outputs": [],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "132aecd4-2c68-431f-a480-83240dcb2432",
   "metadata": {},
   "outputs": [],
   "source": [
    "./kube-state-metrics --help"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f6f37609",
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get pods -A"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "aa0c4c86",
   "metadata": {},
   "outputs": [],
   "source": [
    "cd /root/go/src/github.com/kubernetes/kube-state-metrics"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f84c84ee",
   "metadata": {},
   "outputs": [],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dfa45ad8",
   "metadata": {},
   "outputs": [],
   "source": [
    "make"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cacfc951",
   "metadata": {},
   "outputs": [],
   "source": [
    "go install"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "22b33318",
   "metadata": {},
   "outputs": [],
   "source": [
    "ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "54d1de14",
   "metadata": {},
   "outputs": [],
   "source": [
    "kube-state-metrics"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6d8a52fc",
   "metadata": {},
   "outputs": [],
   "source": [
    "cat ~/.kube/config"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "212cbea5",
   "metadata": {},
   "outputs": [],
   "source": [
    "kube-state-metrics --kubeconfig /root/.kube/config"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "70861430",
   "metadata": {},
   "outputs": [],
   "source": [
    "kube-state-metrics --help"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d61b2e28",
   "metadata": {},
   "outputs": [],
   "source": [
    "curl minikube:8081"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3fad50f7-0a13-47f3-af0a-eb264b10c1e0",
   "metadata": {},
   "source": [
    "# Armosec Kubescape\n",
    "\n",
    "Kubescape is a tool for testing Kubernetes security posture based on NSA \\ MITRE ATT&CK® specifications.\n",
    "\n",
    "\n",
    "https://github.com/armosec/kubescape\n",
    "\n",
    "__Warning: next command installs software from an unknown source__"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "8aea6106",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[0;36mInstalling Kubescape...\n",
      "\n",
      "######################################################################## 100.0%##=O#- #                                                                      \n",
      "\n",
      "\u001b[32mFinished Installation.\n",
      "\u001b[0m\n",
      "Your current version is: v1.0.139\n",
      "\n",
      "\u001b[35mUsage: $ kubescape scan --submit\n",
      "\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "a7504610-703a-4a92-999a-e9a08a90879d",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[1;93mARMO security scanner starting\n",
      "\u001b[0m\u001b[1;36mWarning: Kubernetes cluster nodes scanning is disabled. This is required to collect valuable data for certain controls. You can enable it using  the --enable-host-scan flag\n",
      "\u001b[0m\u001b[1;93m[progress] \u001b[0m\u001b[mDownloading/Loading policy definitions\n",
      "\u001b[0m\u001b[1;92m[success] \u001b[0m\u001b[mDownloaded/Loaded policy\n",
      "\u001b[0m\u001b[1;93m[progress] \u001b[0m\u001b[mAccessing Kubernetes objects\n",
      "\u001b[37m◐\u001b[0mW0119 09:15:59.751995  334291 warnings.go:70] batch/v1beta1 CronJob is deprecated in v1.21+, unavailable in v1.25+; use batch/v1 CronJob\n",
      "W0119 09:15:59.817517  334291 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "\u001b[37m◓\u001b[0mW0119 09:15:59.859309  334291 warnings.go:70] batch/v1beta1 CronJob is deprecated in v1.21+, unavailable in v1.25+; use batch/v1 CronJob\n",
      "\u001b[K\u001b[1;92m[success] \u001b[0m\u001b[mAccessed successfully to Kubernetes objects\n",
      "\u001b[0m\u001b[1;93m[progress] \u001b[0m\u001b[mScanning cluster \n",
      "\u001b[K\u001b[1;92m[success] \u001b[0m\u001b[mDone scanning cluster \n",
      "\u001b[0m\u001b[1;93m[control: Access Kubernetes dashboard - https://hub.armo.cloud/docs/c-0014] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers who gain access to the dashboard service account or have its RBAC permissions can use its network access to retrieve information about resources in the cluster or change them. This control checks if a subject that is not dashboard service account is bound to dashboard role/clusterrole, or - if anyone that is not the dashboard pod is associated with dashboard service account.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:82   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:83\n",
      "\u001b[0m\u001b[2;37mRemediation: Make sure that the “Kubernetes Dashboard” service account is only bound to the Kubernetes dashboard following the least privilege principle.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Access container service account - https://hub.armo.cloud/docs/c-0053] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers who obtain access to a pod can use its SA token to communicate with KubeAPI server. All PODs with SA token mounted (if such token has a Role or a ClusterRole binding) are considerred potentially dangerous.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - storage-provisioner \n",
      "\u001b[0m\u001b[m      ServiceAccount - token-cleaner \n",
      "\u001b[0m\u001b[m      ServiceAccount - storage-provisioner \n",
      "\u001b[0m\u001b[m      ServiceAccount - attachdetach-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - certificate-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - clusterrole-aggregation-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - coredns \n",
      "\u001b[0m\u001b[m      ServiceAccount - cronjob-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - daemon-set-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - deployment-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - disruption-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - endpoint-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - endpointslice-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - endpointslicemirroring-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - ephemeral-volume-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - expand-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - horizontal-pod-autoscaler \n",
      "\u001b[0m\u001b[m      ServiceAccount - job-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - kube-proxy \n",
      "\u001b[0m\u001b[m      ServiceAccount - namespace-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - node-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - persistent-volume-binder \n",
      "\u001b[0m\u001b[m      ServiceAccount - pod-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - pv-protection-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - pvc-protection-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - replicaset-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - replication-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - resourcequota-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - root-ca-cert-publisher \n",
      "\u001b[0m\u001b[m      ServiceAccount - service-account-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - service-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - statefulset-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - storage-provisioner \n",
      "\u001b[0m\u001b[m      ServiceAccount - ttl-after-finished-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - ttl-controller \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:44   \u001b[0m\u001b[1;93mTotal:44\n",
      "\u001b[0m\u001b[2;37mRemediation: Verify that RBAC is enabled. Follow the least privilege principle and ensure that only necessary PODs have SA token mounted into them.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Access tiller endpoint - https://hub.armo.cloud/docs/c-0033] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers may run code on any container that is accessible to the tiller’s service and perform actions in the cluster, using the tiller’s service account, which often has high privileges. This control checks if unauthenticated version of the Tiller runs in the cluster.\n",
      "\u001b[0m\u001b[1;93m[control: Allow privilege escalation - https://hub.armo.cloud/docs/c-0016] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers may gain access to a container and uplift its privilege to enable excessive capabilities.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:3   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:8   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: If your application does not need it, make sure the allowPrivilegeEscalation field of the securityContext is set to false.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Allowed hostPath - https://hub.armo.cloud/docs/c-0006] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Mounting host directory to the container can be abused to get access to sensitive data and gain persistence on the host machine.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:7   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:4   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Refrain from using host path mount.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Applications credentials in configuration files - https://hub.armo.cloud/docs/c-0012] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers who have access to configuration files can steal the stored secrets and use them. This control checks if ConfigMaps or pod specifications have sensitive information in their configuration.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:24   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:24\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Audit logs enabled - https://hub.armo.cloud/docs/c-0067] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Audit logging is an important security feature in Kubernetes, it enables the operator to track requests to the cluster. It is important to use it so the operator has a record of events happened in Kubernetes\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:1\n",
      "\u001b[0m\u001b[2;37mRemediation: Turn on audit logging for your cluster. Look at the vendor guidlines for more details\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Automatic mapping of service account - https://hub.armo.cloud/docs/c-0034] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Potential attacker may gain access to a POD and steal its service account token. Therefore, it is recommended to disable automatic mapping of the service account tokens in service account configuration and enable it only for PODs that need to use them.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - attachdetach-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - certificate-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - clusterrole-aggregation-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - coredns \n",
      "\u001b[0m\u001b[m      ServiceAccount - cronjob-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - daemon-set-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - deployment-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - disruption-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - endpoint-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - endpointslice-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - endpointslicemirroring-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - ephemeral-volume-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - expand-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - horizontal-pod-autoscaler \n",
      "\u001b[0m\u001b[m      ServiceAccount - job-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - kube-proxy \n",
      "\u001b[0m\u001b[m      ServiceAccount - namespace-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - node-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - persistent-volume-binder \n",
      "\u001b[0m\u001b[m      ServiceAccount - pod-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - pv-protection-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - pvc-protection-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - replicaset-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - replication-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - resourcequota-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - root-ca-cert-publisher \n",
      "\u001b[0m\u001b[m      ServiceAccount - service-account-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - service-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - statefulset-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - storage-provisioner \n",
      "\u001b[0m\u001b[m      ServiceAccount - token-cleaner \n",
      "\u001b[0m\u001b[m      ServiceAccount - ttl-after-finished-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - ttl-controller \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      Deployment - coredns \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m   Namespace kube-node-lease\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m   Namespace kube-public\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:6   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:46   \u001b[0m\u001b[1;93mTotal:52\n",
      "\u001b[0m\u001b[2;37mRemediation: Disable automatic mounting of service account tokens to PODs either at the service account level or at the individual POD level, by specifying the automountServiceAccountToken: false. Note that POD level takes precedence.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: CVE-2021-25741 - Using symlink for arbitrary host file system access. - https://hub.armo.cloud/docs/c-0058] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: A user may be able to create a container with subPath or subPathExpr volume mounts to access files & directories anywhere on the host filesystem. Following Kubernetes versions are affected: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. This control checks the vulnerable versions and the actual usage of the subPath feature in all Pods in the cluster.\n",
      "\u001b[0m\u001b[1;93m[control: CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability - https://hub.armo.cloud/docs/c-0059] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Security issue in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster (see more at https://github.com/kubernetes/ingress-nginx/issues/7837)\n",
      "\u001b[0m\u001b[1;93m[control: Cluster internal networking - https://hub.armo.cloud/docs/c-0054] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: If no network policy is defined, attackers who gain access to a container may use it to move laterally in the cluster. This control lists namespaces in which no network policy is defined.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace - default \n",
      "\u001b[0m\u001b[m   Namespace - kube-node-lease \n",
      "\u001b[0m\u001b[m   Namespace - kube-public \n",
      "\u001b[0m\u001b[m   Namespace - kube-system \n",
      "\u001b[0m\u001b[m   Namespace - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:5\n",
      "\u001b[0m\u001b[2;37mRemediation: Define Kubernetes network policies or use alternative products to protect cluster network.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Cluster-admin binding - https://hub.armo.cloud/docs/c-0035] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers who have cluster admin permissions (can perform any action on any resource), can take advantage of their privileges for malicious activities. This control determines which subjects have cluster admin permissions.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:69   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:3   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: You should apply least privilege principle. Make sure cluster admin permissions are granted only when it is absolutely necessary. Don't use subjects with such high permissions for daily operations.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Configured liveness probe - https://hub.armo.cloud/docs/c-0056] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Liveness probe is intended to ensure that workload remains healthy during its entire execution lifecycle, or otherwise restrat the container. It is highly recommended to define liveness probe for every worker container. This control finds all the PODs where the Liveness probe is not configured.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:7   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:4   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Ensure Liveness probes are configured wherever possible.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Configured readiness probe - https://hub.armo.cloud/docs/c-0018] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Readiness probe is intended to ensure that workload is ready to process network traffic. It is highly recommended to define readiness probe for every worker container. This control finds all the PODs where the readiness probe is not configured.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:2   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:9   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Ensure Readiness probes are configured wherever possible.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Container hostPort - https://hub.armo.cloud/docs/c-0044] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Configuring hostPort requires a particular port number. If two objects specify the same HostPort, they could not be deployed to the same node. It may prevent the second object from starting, even if Kubernetes will try reschedule it on another node, provided there are available nodes with sufficient amount of resources. Also, if the number of replicas of such workload is higher than the number of nodes, the deployment will consistantly fail.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Containers mounting Docker socket - https://hub.armo.cloud/docs/c-0074] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Mounting Docker socket (Unix socket) enables container to access Docker internals, retrieve sensitive information and execute Docker commands, if Docker runtime is available. This control identifies PODs that attempt to mount Docker socket for accessing Docker runtime.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Control plane hardening - https://hub.armo.cloud/docs/c-0005] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Kubernetes control plane API is running with non-secure port enabled which allows attackers to gain unprotected access to the cluster.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:1   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:1\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: CoreDNS poisoning - https://hub.armo.cloud/docs/c-0037] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: If attackers have permissions to modify the coredns ConfigMap they can change the behavior of the cluster’s DNS, poison it, and override the network identity of other services. This control identifies all subjects allowed to update the 'coredns' configmap.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - root-ca-cert-publisher \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:67   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: You should follow the least privilege principle. Monitor and approve all the subjects allowed to modify the 'coredns' configmap. It is also recommended to remove this permission from the users/service accounts used in the daily operations.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Data Destruction - https://hub.armo.cloud/docs/c-0007] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers may attempt to destroy data and resources in the cluster. This includes deleting deployments, configurations, storage, and compute resources. This control identifies all subjects that can delete resources.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - cronjob-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - daemon-set-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - deployment-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - job-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - namespace-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - node-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - persistent-volume-binder \n",
      "\u001b[0m\u001b[m      ServiceAccount - pod-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - replicaset-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - replication-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - statefulset-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - ttl-after-finished-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - token-cleaner \n",
      "\u001b[0m\u001b[m   Users\n",
      "\u001b[0m\u001b[m      User - system:kube-controller-manager \n",
      "\u001b[0m\u001b[m      User - system:kube-scheduler \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:52   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:20   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: You should follow the least privilege principle and minimize the number of subjects that can delete resources.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Delete Kubernetes events - https://hub.armo.cloud/docs/c-0031] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers may delete Kubernetes events to avoid detection of their activity in the cluster. This control identifies all the subjects that can delete Kubernetes events.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - namespace-controller \n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:67   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: You should follow the least privilege principle. Minimize the number of subjects who can delete Kubernetes events. Avoid using these subjects in the daily operations.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Disable anonymous access to Kubelet service - https://hub.armo.cloud/docs/c-0069] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.\n",
      "\u001b[0m\u001b[1;93m[control: Enforce Kubelet client TLS authentication - https://hub.armo.cloud/docs/c-0070] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Kubelets are the node level orchestrator in Kubernetes control plane. They are publishing service port 10250 where they accept commands from API server. Operator must make sure that only API server is allowed to submit commands to Kubelet. This is done through client certificate verification, must configure Kubelet with client CA file to use for this purpose.\n",
      "\u001b[0m\u001b[1;93m[control: Exec into container - https://hub.armo.cloud/docs/c-0002] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers with relevant permissions can run malicious commands in the context of legitimate containers in the cluster using “kubectl exec” command. This control determines which subjects have permissions to use this command.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:69   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:3   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: It is recommended to prohibit “kubectl exec” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Exposed dashboard - https://hub.armo.cloud/docs/c-0047] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Kubernetes dashboard versions before v2.0.1 do not support user authentication. If exposed externally, it will allow unauthenticated remote management of the cluster. This control checks presence of the kubernetes-dashboard deployment and its version number.\n",
      "\u001b[0m\u001b[1;93m[control: Exposed sensitive interfaces - https://hub.armo.cloud/docs/c-0021] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Exposing a sensitive interface to the internet poses a security risk. It might enable attackers to run malicious code or deploy containers in the cluster. This control checks if known components (e.g. Kubeflow, Argo Workflows, etc.) are deployed and exposed services externally.\n",
      "\u001b[0m\u001b[1;93m[control: Host PID/IPC privileges - https://hub.armo.cloud/docs/c-0038] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Containers should be isolated from the host machine as much as possible. The hostPID and hostIPC fields in deployment yaml may allow cross-container influence and may expose the host itself to potentially malicious or destructive actions. This control identifies all PODs using hostPID or hostIPC privileges.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:10   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Remove hostPID and hostIPC from the yaml file(s) privileges unless they are absolutely necessary.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: HostNetwork access - https://hub.armo.cloud/docs/c-0041] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Potential attackers may gain access to a POD and inherit access to the entire host network. For example, in AWS case, they will have access to the entire VPC. This control identifies all the PODs with host network access enabled.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:5   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:6   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Only connect PODs to host network when it is necessary. If not, set the hostNetwork field of the pod spec to false, or completely remove it (false is the default). Whitelist only those PODs that must have access to host network by design.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: HostPath mount - https://hub.armo.cloud/docs/c-0048] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Mounting host directory to the container can be used by attackers to get access to the underlying host. This control identifies all the PODs using hostPath mount.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:6   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Remove hostPath mounts unless they are absolutely necessary and use exception mechanism to remove notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Image pull policy on latest image tag - https://hub.armo.cloud/docs/c-0064] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Check all images with latest tag (or no tag at all) that have the 'imagePullPolicy' field set to 'Never' or 'IfNotPresent'. If exist, Kubernetes may run older version of the container images (if they happen to be cached on a node) without user knowing about this.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Image pull policy on latest tag - https://hub.armo.cloud/docs/c-0075] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: While usage of the latest tag is not generally recommended, in some cases this is necessary. If it is, the ImagePullPolicy must be set to Always, otherwise Kubernetes may run an older image with the same name that happens to be present in the node cache. Note that using Always will not cause additional image downloads because Kubernetes will check the image hash of the local local against the registry and only pull the image if this hash has changed, which is exactly what users want when use the latest tag. This control will identify all PODs with latest tag that have ImagePullSecret not set to Always.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Immutable container filesystem - https://hub.armo.cloud/docs/c-0017] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Mutable container filesystem can be abused to inject malicious code or data into containers. Use immutable (read-only) filesystem to limit potential attacks.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:3   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:8   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Set the filesystem of the container to read-only when possible (POD securityContext, readOnlyRootFilesystem: true). If containers application needs to write into the filesystem, it is recommended to mount secondary filesystems for specific directories where application require write access.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Ingress and Egress blocked - https://hub.armo.cloud/docs/c-0030] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Disable Ingress and Egress traffic on all pods wherever possible. It is recommended to define restrictive network policy on all new PODs, and then enable sources/destinations that this POD must communicate with.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      Deployment - coredns \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:11   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Define a network policy that restricts ingress and egress connections.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Insecure capabilities - https://hub.armo.cloud/docs/c-0046] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Giving insecure or excsessive capabilities to a container can increase the impact of the container compromise. This control identifies all the PODs with dangerous capabilities (see documentation pages for details).\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: K8s common labels usage - https://hub.armo.cloud/docs/c-0077] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Kubernetes common labels help manage and monitor Kubernetes cluster using different tools such as kubectl, dashboard and others in an interoperable way. Refer to https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ for more information. This contol helps you find objects that don't have any of these labels defined.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      Deployment - coredns \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:11   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Define applicable labels or use the exception mechanism to prevent further notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Kubernetes CronJob - https://hub.armo.cloud/docs/c-0026] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a POD in the cluster. This control lists all the CronJobs that exist in the cluster for the user to approve.\n",
      "\u001b[0m\u001b[1;93m[control: Label usage for resources - https://hub.armo.cloud/docs/c-0076] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: It is recommended to set labels that identify semantic attributes of your application or deployment. For example, { app: myapp, tier: frontend, phase: test, deployment: v3 }. These labels can used to asign policies to logical groups of the deployments as well as for presentation and tracking purposes. This control helps you find deployments without any of the expected labels.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      Deployment - coredns \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:6   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Define labels that are most suitable to your needs of use the excpetions to prevent further notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Linux hardening - https://hub.armo.cloud/docs/c-0055] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Containers may be given more privileges than they actually need. This can increase the potential impact of a container compromise.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:5   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:6   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: You can use AppArmor, Seccomp, SELinux and Linux Capabilities mechanisms to restrict containers abilities to utilize unwanted privileges.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: List Kubernetes secrets - https://hub.armo.cloud/docs/c-0015] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers who have permissions to access secrets can access sensitive information that might include credentials to various services. This control determines which user, group or service account can list/get secrets.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Users\n",
      "\u001b[0m\u001b[m      User - system:kube-controller-manager \n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - expand-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - namespace-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - persistent-volume-binder \n",
      "\u001b[0m\u001b[m      ServiceAccount - resourcequota-controller \n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - bootstrap-signer \n",
      "\u001b[0m\u001b[m      ServiceAccount - token-cleaner \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:59   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:13   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: Monitor and approve list of users, groups and service accounts that can access secrets. Use exception mechanism to prevent repetitive the notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Malicious admission controller (mutating) - https://hub.armo.cloud/docs/c-0039] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers may use mutating webhooks to intercept and modify all the resources in the cluster. This control lists all mutating webhook configurations that must be verified.\n",
      "\u001b[0m\u001b[1;93m[control: Malicious admission controller (validating) - https://hub.armo.cloud/docs/c-0036] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers can use validating webhooks to intercept and discover all the resources in the cluster. This control lists all the validating webhook configurations that must be verified.\n",
      "\u001b[0m\u001b[1;93m[control: Mount service principal - https://hub.armo.cloud/docs/c-0020] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: When a cluster is deployed in the cloud, in some cases attackers can leverage their access to a container in the cluster to gain cloud credentials. This control determines if any workload contains a hostPath volume.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:6   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Refrain from using host path mount.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Naked PODs - https://hub.armo.cloud/docs/c-0073] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: It is not recommended to create PODs without parental Deployment, ReplicaSet, StatefulSet etc.Manual creation if PODs may lead to a configuration drifts and other untracked changes in the system. Such PODs won't be automatically rescheduled by Kubernetes in case of a crash or infrastructure failure. This control identifies every POD that does not have corresponding parental object.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:12   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:13\n",
      "\u001b[0m\u001b[2;37mRemediation: Create necessary Deployment object for every POD making any POD a first class citizen in your IaC architecture.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Namespace without service accounts - https://hub.armo.cloud/docs/c-0060] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: It is recommended not to use default service account anywhere in production environment. This control identifies all namespaces without explicit non-default service account.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace - default \n",
      "\u001b[0m\u001b[m   Namespace - kube-node-lease \n",
      "\u001b[0m\u001b[m   Namespace - kube-public \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:43   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:3   \u001b[0m\u001b[1;93mTotal:46\n",
      "\u001b[0m\u001b[2;37mRemediation: Assign explicit service account to every namespace. Reduce RBAC capabilities of such service account to a minimum. Don't allow even read permissions unless it is absolutely necessary.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: No impersonation - https://hub.armo.cloud/docs/c-0065] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Impersonation is an explicit RBAC permission to use other roles rather than the one assigned to a user, group or service account. This is sometimes needed for testing purposes. However, it is highly recommended not to use this capability in the production environments for daily operations. This control identifies all subjects whose roles include impersonate verb.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:69   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:3   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: Either remove the impersonate verb from the role where it was found or make sure that this role is not bound to users, groups or service accounts used for ongoing cluster operations. If necessary, bind this role to a subject only for specific needs for limited time period.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Non-root containers - https://hub.armo.cloud/docs/c-0013] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Potential attackers may gain access to a container and leverage its existing privileges to conduct an attack. Therefore, it is not recommended to deploy containers with root privileges unless it is absolutely necessary. This contol identifies all the Pods running as root or can escalate to root.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: PSP enabled - https://hub.armo.cloud/docs/c-0068] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: PSP enable fine-grained authorization of pod creation and it is important to enable it\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:1\n",
      "\u001b[0m\u001b[2;37mRemediation: Turn Pod Security Policies on in your cluster, if you use other admission controllers to control the behavior that PSP controls, exclude this control from your scans\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Pods in default namespace - https://hub.armo.cloud/docs/c-0061] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: It is recommended to avoid running PODs in cluster without explicit namespace assignment. This control identifies all the PODs running in the default namespace.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:9   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:2   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Create necessary namespaces and move all the PODs from default namespace there.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Portforwarding privileges - https://hub.armo.cloud/docs/c-0063] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Attackers with relevant RBAC permission can use “kubectl portforward” command to establish direct communication with PODs from within the cluster or even remotely. Such communication will most likely bypass existing security measures in the cluster. This control determines which subjects have permissions to use this command.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      ServiceAccount - default \n",
      "\u001b[0m\u001b[m      ServiceAccount - generic-garbage-collector \n",
      "\u001b[0m\u001b[m      ServiceAccount - namespace-controller \n",
      "\u001b[0m\u001b[m   Groups\n",
      "\u001b[0m\u001b[m      Group - system:masters \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      ServiceAccount - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:67   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:5   \u001b[0m\u001b[1;93mTotal:72\n",
      "\u001b[0m\u001b[2;37mRemediation: It is recommended to prohibit “kubectl portforward” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Privileged container - https://hub.armo.cloud/docs/c-0057] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Potential attackers may gain access to privileged containers and inherit access to the host resources. Therefore, it is not recommended to deploy privileged containers unless it is absolutely necessary. This control identifies all the privileged Pods.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:10   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Remove privileged capabilities by setting the securityContext.privileged to false. If you must deploy a Pod as privileged, add other restriction to it, such as network policy, Seccomp etc and still remove all unnecessary capabilities. Use the exception mechanism to remove unnecessary notifocations.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Resource policies - https://hub.armo.cloud/docs/c-0009] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: CPU and memory resources should have a limit set for every container or a namespace to prevent resource exhaustion. This control identifies all the Pods without resource limit definitions by checking thier yaml definition file as well as their namespace LimitRange objects. It is also recommended to use ResourceQuota object to restrict overall namespace resources, but this is not verified by this control.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      Deployment - coredns \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:11   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Define LimitRange and Resource Limits in the namespace or in the deployment/POD yamls.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Resources CPU limit and request - https://hub.armo.cloud/docs/c-0050] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: This control identifies all Pods for which the CPU limit is not set.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      Deployment - coredns \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:11   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Set the CPU limit or use exception mechanism to avoid unnecessary notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Resources memory limit and request - https://hub.armo.cloud/docs/c-0004] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: This control identifies all Pods for which the memory limit is not set.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kubernetes-dashboard\n",
      "\u001b[0m\u001b[m      Deployment - dashboard-metrics-scraper \n",
      "\u001b[0m\u001b[m      Deployment - kubernetes-dashboard \n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-scheduler-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[m   Namespace default\n",
      "\u001b[0m\u001b[m      Deployment - nginx-strict \n",
      "\u001b[0m\u001b[m      Job - kube-bench \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:1   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:10   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Set the memory limit or use exception mechanism to avoid unnecessary notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: SSH server running inside container - https://hub.armo.cloud/docs/c-0042] \u001b[0m\u001b[1;93mskipped 😕\n",
      "\u001b[0m\u001b[2;37mDescription: An SSH server that is running inside a container may be used by attackers to get remote access to the container. This control checks if pods have an open SSH port (22/2222).\n",
      "\u001b[0m\u001b[1;93m[control: Secret/ETCD encryption enabled - https://hub.armo.cloud/docs/c-0066] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: All Kubernetes Secrets are stored primarily in etcd therefore it is important to encrypt it.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - kube-apiserver-minikube \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:0   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:1   \u001b[0m\u001b[1;93mTotal:1\n",
      "\u001b[0m\u001b[2;37mRemediation: Turn on the etcd encryption in your cluster, for more see the vendor documentation.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Sudo in container entrypoint - https://hub.armo.cloud/docs/c-0062] \u001b[0m\u001b[1;92mpassed 👍\n",
      "\u001b[0m\u001b[2;37mDescription: Adding sudo to a container entry point command may escalate process privileges and allow access to forbiden resources. This control checks all the entry point commands in all containers in the POD to find those that have sudo command.\n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:11   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:0   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93m[control: Writable hostPath mount - https://hub.armo.cloud/docs/c-0045] \u001b[0m\u001b[1;91mfailed 😥\n",
      "\u001b[0m\u001b[2;37mDescription: Mounting host directory to the container can be used by attackers to get access to the underlying host and gain persistence.\n",
      "\u001b[0m\u001b[1;91mFailed:\n",
      "\u001b[0m\u001b[m   Namespace kube-system\n",
      "\u001b[0m\u001b[m      Pod - etcd-minikube \n",
      "\u001b[0m\u001b[m      Pod - kube-controller-manager-minikube \n",
      "\u001b[0m\u001b[m      Pod - storage-provisioner \n",
      "\u001b[0m\u001b[m      DaemonSet - kube-proxy \n",
      "\u001b[0m\u001b[mSummary - \u001b[0m\u001b[1;92mPassed:7   \u001b[0m\u001b[1;36mExcluded:0   \u001b[0m\u001b[1;91mFailed:4   \u001b[0m\u001b[1;93mTotal:11\n",
      "\u001b[0m\u001b[2;37mRemediation: Refrain from using the hostPath mount or use the exception mechanism to remove unnecessary notifications.\n",
      "\u001b[0m\u001b[2;37m\n",
      "\u001b[0m\u001b[1;93mFRAMEWORKS: NSA (risk: 26.51), MITRE (risk: 18.92), ArmoBest (risk: 19.89), DevOpsBest (risk: 50.97)\n",
      "\u001b[0m+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+\n",
      "|                             CONTROL NAME                              | FAILED RESOURCES | EXCLUDED RESOURCES | ALL RESOURCES | % RISK-SCORE |\n",
      "+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+\n",
      "| Access Kubernetes dashboard                                           |        1         |         0          |      83       |      1%      |\n",
      "| Access container service account                                      |        44        |         0          |      44       |     100%     |\n",
      "| Access tiller endpoint                                                |        0         |         0          |       0       |   skipped    |\n",
      "| Allow privilege escalation                                            |        8         |         0          |      11       |     77%      |\n",
      "| Allowed hostPath                                                      |        4         |         0          |      11       |     30%      |\n",
      "| Applications credentials in configuration files                       |        0         |         0          |      24       |      0%      |\n",
      "| Audit logs enabled                                                    |        1         |         0          |       1       |     100%     |\n",
      "| Automatic mapping of service account                                  |        46        |         0          |      52       |     84%      |\n",
      "| CVE-2021-25741 - Using symlink for arbitrary host file system access. |        0         |         0          |       0       |   skipped    |\n",
      "| CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability         |        0         |         0          |       0       |   skipped    |\n",
      "| Cluster internal networking                                           |        5         |         0          |       5       |     100%     |\n",
      "| Cluster-admin binding                                                 |        3         |         0          |      72       |      4%      |\n",
      "| Configured liveness probe                                             |        4         |         0          |      11       |     47%      |\n",
      "| Configured readiness probe                                            |        9         |         0          |      11       |     84%      |\n",
      "| Container hostPort                                                    |        0         |         0          |      11       |      0%      |\n",
      "| Containers mounting Docker socket                                     |        0         |         0          |      11       |      0%      |\n",
      "| Control plane hardening                                               |        0         |         0          |       1       |      0%      |\n",
      "| CoreDNS poisoning                                                     |        5         |         0          |      72       |      6%      |\n",
      "| Data Destruction                                                      |        20        |         0          |      72       |     27%      |\n",
      "| Delete Kubernetes events                                              |        5         |         0          |      72       |      6%      |\n",
      "| Disable anonymous access to Kubelet service                           |        0         |         0          |       0       |   skipped    |\n",
      "| Enforce Kubelet client TLS authentication                             |        0         |         0          |       0       |   skipped    |\n",
      "| Exec into container                                                   |        3         |         0          |      72       |      4%      |\n",
      "| Exposed dashboard                                                     |        0         |         0          |       0       |   skipped    |\n",
      "| Exposed sensitive interfaces                                          |        0         |         0          |       0       |   skipped    |\n",
      "| Host PID/IPC privileges                                               |        1         |         0          |      11       |      7%      |\n",
      "| HostNetwork access                                                    |        6         |         0          |      11       |     45%      |\n",
      "| HostPath mount                                                        |        5         |         0          |      11       |     37%      |\n",
      "| Image pull policy on latest image tag                                 |        0         |         0          |      11       |      0%      |\n",
      "| Image pull policy on latest tag                                       |        0         |         0          |      11       |      0%      |\n",
      "| Immutable container filesystem                                        |        8         |         0          |      11       |     77%      |\n",
      "| Ingress and Egress blocked                                            |        11        |         0          |      11       |     100%     |\n",
      "| Insecure capabilities                                                 |        0         |         0          |      11       |      0%      |\n",
      "| K8s common labels usage                                               |        11        |         0          |      11       |     100%     |\n",
      "| Kubernetes CronJob                                                    |        0         |         0          |       0       |   skipped    |\n",
      "| Label usage for resources                                             |        5         |         0          |      11       |     37%      |\n",
      "| Linux hardening                                                       |        6         |         0          |      11       |     62%      |\n",
      "| List Kubernetes secrets                                               |        13        |         0          |      72       |     18%      |\n",
      "| Malicious admission controller (mutating)                             |        0         |         0          |       0       |   skipped    |\n",
      "| Malicious admission controller (validating)                           |        0         |         0          |       0       |   skipped    |\n",
      "| Mount service principal                                               |        5         |         0          |      11       |     37%      |\n",
      "| Naked PODs                                                            |        1         |         0          |      13       |      7%      |\n",
      "| Namespace without service accounts                                    |        3         |         0          |      46       |      6%      |\n",
      "| No impersonation                                                      |        3         |         0          |      72       |      4%      |\n",
      "| Non-root containers                                                   |        0         |         0          |      11       |      0%      |\n",
      "| PSP enabled                                                           |        1         |         0          |       1       |     100%     |\n",
      "| Pods in default namespace                                             |        2         |         0          |      11       |     32%      |\n",
      "| Portforwarding privileges                                             |        5         |         0          |      72       |      6%      |\n",
      "| Privileged container                                                  |        1         |         0          |      11       |      7%      |\n",
      "| Resource policies                                                     |        11        |         0          |      11       |     100%     |\n",
      "| Resources CPU limit and request                                       |        11        |         0          |      11       |     100%     |\n",
      "| Resources memory limit and request                                    |        10        |         0          |      11       |     92%      |\n",
      "| SSH server running inside container                                   |        0         |         0          |       0       |   skipped    |\n",
      "| Secret/ETCD encryption enabled                                        |        1         |         0          |       1       |     100%     |\n",
      "| Sudo in container entrypoint                                          |        0         |         0          |      11       |      0%      |\n",
      "| Writable hostPath mount                                               |        4         |         0          |      11       |     30%      |\n",
      "+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+\n",
      "|                           RESOURCE SUMMARY                            |       104        |         0          |      152      |    29.07%    |\n",
      "+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+\n",
      "missing account ID or cluster name. AccountID: '714f15fa-30d9-479b-88cc-6cc0f5256e33', Cluster name: ''\n",
      "\u001b[1;93m\n",
      "\n",
      "You can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more by registering here: https://portal.armo.cloud/account/sign-up?customerGUID=714f15fa-30d9-479b-88cc-6cc0f5256e33&invitationToken=0iQ94ArRDOkOAOgUBmoLyKi75t11cjPQmeHRi0v9saK1tucf7QS73AmwDuTUNc0x1IRYblrF8MHehjn57NaWS806OtGpuxElAhf4jUYHxJMdQYToWupEx7DtO9HjCrRf\n",
      "\n",
      "\u001b[0m"
     ]
    }
   ],
   "source": [
    "kubescape scan --submit"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d78709ba-f255-4190-b38b-131b324ee635",
   "metadata": {},
   "outputs": [],
   "source": [
    "kubescape --help"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2b03f93a-b2a7-4e87-a553-b98d9e1d97a1",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}