aboutsummaryrefslogtreecommitdiffstats
path: root/test/security/k8s/src/check
diff options
context:
space:
mode:
authorPawel Wieczorek <p.wieczorek2@samsung.com>2019-09-27 16:26:39 +0200
committerPawel Wieczorek <p.wieczorek2@samsung.com>2019-09-27 18:06:10 +0200
commit744f732b177c2449ab3ac2ee0ed8fa316122f393 (patch)
tree7673407d9db9be58c0fcdfa0c890aabf9a838e8a /test/security/k8s/src/check
parent96f4e2fe0ef3bfaf8371f29562ecb6129f20e3ab (diff)
k8s: Validate scheduler flags
Issue-ID: SECCOM-235 Change-Id: I61df142e99a7f1da335471acab88e5a47d72df15 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
Diffstat (limited to 'test/security/k8s/src/check')
-rw-r--r--test/security/k8s/src/check/cmd/check/check.go3
-rw-r--r--test/security/k8s/src/check/validators/master/master.go8
-rw-r--r--test/security/k8s/src/check/validators/master/scheduler/scheduler.go17
-rw-r--r--test/security/k8s/src/check/validators/master/scheduler/scheduler_suite_test.go13
-rw-r--r--test/security/k8s/src/check/validators/master/scheduler/scheduler_test.go61
5 files changed, 101 insertions, 1 deletions
diff --git a/test/security/k8s/src/check/cmd/check/check.go b/test/security/k8s/src/check/cmd/check/check.go
index e60912801..2d25100f3 100644
--- a/test/security/k8s/src/check/cmd/check/check.go
+++ b/test/security/k8s/src/check/cmd/check/check.go
@@ -43,8 +43,9 @@ func main() {
}
master.CheckAPI(apiParams)
- _, err = info.GetSchedulerParams()
+ schedulerParams, err := info.GetSchedulerParams()
if err != nil {
log.Fatal(err)
}
+ master.CheckScheduler(schedulerParams)
}
diff --git a/test/security/k8s/src/check/validators/master/master.go b/test/security/k8s/src/check/validators/master/master.go
index ff3b79648..bc019a67a 100644
--- a/test/security/k8s/src/check/validators/master/master.go
+++ b/test/security/k8s/src/check/validators/master/master.go
@@ -4,6 +4,7 @@ import (
"log"
"check/validators/master/api"
+ "check/validators/master/scheduler"
)
// CheckAPI validates API server complies with CIS guideliness.
@@ -56,3 +57,10 @@ func CheckAPI(params []string) {
log.Printf("IsStrongCryptoCipherInUse: %t\n", api.IsStrongCryptoCipherInUse(params))
}
+
+// CheckScheduler validates scheduler complies with CIS guideliness.
+func CheckScheduler(params []string) {
+ log.Println("==> Scheduler:")
+ log.Printf("IsProfilingDisabled: %t\n", scheduler.IsProfilingDisabled(params))
+ log.Printf("IsInsecureBindAddressAbsentOrLoopback: %t\n", scheduler.IsInsecureBindAddressAbsentOrLoopback(params))
+}
diff --git a/test/security/k8s/src/check/validators/master/scheduler/scheduler.go b/test/security/k8s/src/check/validators/master/scheduler/scheduler.go
new file mode 100644
index 000000000..14a0fa22e
--- /dev/null
+++ b/test/security/k8s/src/check/validators/master/scheduler/scheduler.go
@@ -0,0 +1,17 @@
+package scheduler
+
+import (
+ "check/validators/master/args"
+ "check/validators/master/boolean"
+)
+
+// IsProfilingDisabled validates there is single "--profiling" flag and it is set to "false".
+func IsProfilingDisabled(params []string) bool {
+ return args.HasSingleFlagArgument("--profiling=", "false", params)
+}
+
+// IsInsecureBindAddressAbsentOrLoopback validates there is no insecure bind address or it is loopback address.
+func IsInsecureBindAddressAbsentOrLoopback(params []string) bool {
+ return boolean.IsFlagAbsent("--address=", params) ||
+ args.HasSingleFlagArgument("--address=", "127.0.0.1", params)
+}
diff --git a/test/security/k8s/src/check/validators/master/scheduler/scheduler_suite_test.go b/test/security/k8s/src/check/validators/master/scheduler/scheduler_suite_test.go
new file mode 100644
index 000000000..8f8320808
--- /dev/null
+++ b/test/security/k8s/src/check/validators/master/scheduler/scheduler_suite_test.go
@@ -0,0 +1,13 @@
+package scheduler_test
+
+import (
+ "testing"
+
+ . "github.com/onsi/ginkgo"
+ . "github.com/onsi/gomega"
+)
+
+func TestScheduler(t *testing.T) {
+ RegisterFailHandler(Fail)
+ RunSpecs(t, "Scheduler Suite")
+}
diff --git a/test/security/k8s/src/check/validators/master/scheduler/scheduler_test.go b/test/security/k8s/src/check/validators/master/scheduler/scheduler_test.go
new file mode 100644
index 000000000..4166a58d7
--- /dev/null
+++ b/test/security/k8s/src/check/validators/master/scheduler/scheduler_test.go
@@ -0,0 +1,61 @@
+package scheduler_test
+
+import (
+ . "github.com/onsi/ginkgo/extensions/table"
+
+ . "github.com/onsi/ginkgo"
+ . "github.com/onsi/gomega"
+
+ . "check/validators/master/scheduler"
+)
+
+var _ = Describe("Scheduler", func() {
+ var (
+ // kubeSchedulerCISCompliant uses secure defaults or follows CIS guidelines explicitly.
+ kubeSchedulerCISCompliant = []string{
+ "--profiling=false",
+ }
+
+ // kubeSchedulerCasablanca was obtained from virtual environment for testing
+ // (introduced in Change-Id: I57f9f3caac0e8b391e9ed480f6bebba98e006882).
+ kubeSchedulerCasablanca = []string{
+ "--kubeconfig=/etc/kubernetes/ssl/kubeconfig",
+ "--address=0.0.0.0",
+ }
+
+ // kubeSchedulerCasablanca was obtained from virtual environment for testing
+ // (introduced in Change-Id: I54ada5fade3b984dedd1715f20579e3ce901faa3).
+ kubeSchedulerDublin = []string{
+ "--kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml",
+ "--address=0.0.0.0",
+ "--profiling=false",
+ "--leader-elect=true",
+ "--v=2",
+ }
+ )
+
+ Describe("Boolean flag", func() {
+ DescribeTable("Profiling",
+ func(params []string, expected bool) {
+ Expect(IsProfilingDisabled(params)).To(Equal(expected))
+ },
+ Entry("Is not set on insecure cluster", []string{}, false),
+ Entry("Is explicitly enabled on insecure cluster", []string{"--profiling=true"}, false),
+ Entry("Is not set on Casablanca cluster", kubeSchedulerCasablanca, false),
+ Entry("Should be set to false on CIS-compliant cluster", kubeSchedulerCISCompliant, true),
+ Entry("Should be set to false on Dublin cluster", kubeSchedulerDublin, true),
+ )
+ })
+
+ Describe("Address flag", func() {
+ DescribeTable("Bind address",
+ func(params []string, expected bool) {
+ Expect(IsInsecureBindAddressAbsentOrLoopback(params)).To(Equal(expected))
+ },
+ Entry("Is not absent on insecure cluster", []string{"--address=1.2.3.4"}, false),
+ Entry("Is not absent nor set to loopback on Casablanca cluster", kubeSchedulerCasablanca, false),
+ Entry("Is not absent nor set to loopback on Dublin cluster", kubeSchedulerDublin, false),
+ Entry("Should be absent or set to loopback on CIS-compliant cluster", kubeSchedulerCISCompliant, true),
+ )
+ })
+})