diff options
Diffstat (limited to 'test')
| -rw-r--r-- | test/security/k8s/README | 45 | ||||
| -rw-r--r--[l---------] | test/security/k8s/README.rst | 46 | ||||
| -rw-r--r-- | test/security/sslendpoints/README | 135 | ||||
| -rw-r--r--[l---------] | test/security/sslendpoints/README.rst | 136 |
4 files changed, 180 insertions, 182 deletions
diff --git a/test/security/k8s/README b/test/security/k8s/README deleted file mode 100644 index b9e2dd5d2..000000000 --- a/test/security/k8s/README +++ /dev/null @@ -1,45 +0,0 @@ -############################## -K8s secure configuration check -############################## - -Utility for checking if Kubernetes cluster configuration follows security recommendations. - -*************** -Getting started -*************** - -Prerequisites -============= - -Build ------ - -- make -- go_ - -.. _go: https://golang.org/doc/install - -Test ----- - -- Ginkgo_ - -.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo - -Running -======= - -Calling:: - - make run - -will build and run configuration check executable. It is the default target. - -Testing -======= - -Calling:: - - make test - -will run tests. diff --git a/test/security/k8s/README.rst b/test/security/k8s/README.rst index 100b93820..b9e2dd5d2 120000..100644 --- a/test/security/k8s/README.rst +++ b/test/security/k8s/README.rst @@ -1 +1,45 @@ -README
\ No newline at end of file +############################## +K8s secure configuration check +############################## + +Utility for checking if Kubernetes cluster configuration follows security recommendations. + +*************** +Getting started +*************** + +Prerequisites +============= + +Build +----- + +- make +- go_ + +.. _go: https://golang.org/doc/install + +Test +---- + +- Ginkgo_ + +.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo + +Running +======= + +Calling:: + + make run + +will build and run configuration check executable. It is the default target. + +Testing +======= + +Calling:: + + make test + +will run tests. diff --git a/test/security/sslendpoints/README b/test/security/sslendpoints/README deleted file mode 100644 index 257946d88..000000000 --- a/test/security/sslendpoints/README +++ /dev/null @@ -1,135 +0,0 @@ -===================== - SSL endpoints check -===================== - -Utility for checking if all of the ports exposed outside of Kubernetes cluster -use SSL tunnels. - -Prerequisites -------------- - -Configuration -~~~~~~~~~~~~~ - -``-kubeconfig`` - Optional unless ``$HOME`` is not set. Defaults to ``$HOME/.kube/config``. - -``-xfail`` - Optional list of services with corresponding NodePorts which do not use SSL - tunnels. These ports are known as "expected failures" and will not be - checked. - -Dependencies -~~~~~~~~~~~~ - -- nmap_ - -.. _nmap: https://nmap.org/book/install.html - -Build (local) -~~~~~~~~~~~~~ - -- go_ (1.11+, tested on 1.13) - -.. _go: https://golang.org/doc/install - -Build (Docker) -~~~~~~~~~~~~~~ - -- Docker_ engine -- make (optional) - -.. _Docker: https://docs.docker.com/install - -Test -~~~~ - -- Ginkgo_ -- GolangCI-Lint_ (optional) - -.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo -.. _GolangCI-Lint: https://github.com/golangci/golangci-lint#install - -Building --------- - -Command (local) -~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ mkdir bin - $ go build -o bin/sslendpoints - -Additional ``bin`` directory and specifying ``go build`` output are used to -declutter project and maintain compatibility with Docker-based process. Running -``go build`` without parameters will create ``sslendpoints`` binary in current -directory. - -Command (Docker) -~~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ make # or commands from corresponding "make" targets - - -Running -------- - -Command (local) -~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ bin/sslendpoints [-kubeconfig KUBECONFIG] [-xfail XFAIL] - -Command (Docker) -~~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ docker run --rm --volume $KUBECONFIG:/.kube/config \ - sslendpoints-build-img /bin/sslendpoints - - $ docker run --rm --volume $KUBECONFIG:/opt/config \ - sslendpoints-build-img /bin/sslendpoints -kubeconfig /opt/config - - $ docker run --rm \ - --volume $KUBECONFIG:/opt/config \ - --volume $XFAIL:/opt/xfail \ - sslendpoints-build-img /bin/sslendpoints \ - -kubeconfig /opt/config - -xfail /opt/xfail - -Output -~~~~~~ - -.. code-block:: shell - - $ ./sslendpoints -kubeconfig ~/.kube/config.onap - 2020/03/17 10:40:29 Host 192.168.2.10 - 2020/03/17 10:40:29 PORT SERVICE - 2020/03/17 10:40:29 30203 sdnc-dgbuilder - 2020/03/17 10:40:29 30204 sdc-be - 2020/03/17 10:40:29 30207 sdc-fe - 2020/03/17 10:40:29 30220 aai-sparky-be - 2020/03/17 10:40:29 30226 message-router - 2020/03/17 10:40:29 30233 aai - 2020/03/17 10:40:29 30256 sdc-wfd-fe - 2020/03/17 10:40:29 30257 sdc-wfd-be - 2020/03/17 10:40:29 30264 sdc-dcae-fe - 2020/03/17 10:40:29 30266 sdc-dcae-dt - 2020/03/17 10:40:29 30279 aai-babel - 2020/03/17 10:40:29 30406 so-vnfm-adapter - 2020/03/17 10:40:29 There are 12 non-SSL NodePorts in the cluster - - -Testing -------- - -.. code-block:: shell - - $ go test ./... # basic - $ ginkgo -r # pretty - $ golangci-lint run # linters diff --git a/test/security/sslendpoints/README.rst b/test/security/sslendpoints/README.rst index 100b93820..257946d88 120000..100644 --- a/test/security/sslendpoints/README.rst +++ b/test/security/sslendpoints/README.rst @@ -1 +1,135 @@ -README
\ No newline at end of file +===================== + SSL endpoints check +===================== + +Utility for checking if all of the ports exposed outside of Kubernetes cluster +use SSL tunnels. + +Prerequisites +------------- + +Configuration +~~~~~~~~~~~~~ + +``-kubeconfig`` + Optional unless ``$HOME`` is not set. Defaults to ``$HOME/.kube/config``. + +``-xfail`` + Optional list of services with corresponding NodePorts which do not use SSL + tunnels. These ports are known as "expected failures" and will not be + checked. + +Dependencies +~~~~~~~~~~~~ + +- nmap_ + +.. _nmap: https://nmap.org/book/install.html + +Build (local) +~~~~~~~~~~~~~ + +- go_ (1.11+, tested on 1.13) + +.. _go: https://golang.org/doc/install + +Build (Docker) +~~~~~~~~~~~~~~ + +- Docker_ engine +- make (optional) + +.. _Docker: https://docs.docker.com/install + +Test +~~~~ + +- Ginkgo_ +- GolangCI-Lint_ (optional) + +.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo +.. _GolangCI-Lint: https://github.com/golangci/golangci-lint#install + +Building +-------- + +Command (local) +~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ mkdir bin + $ go build -o bin/sslendpoints + +Additional ``bin`` directory and specifying ``go build`` output are used to +declutter project and maintain compatibility with Docker-based process. Running +``go build`` without parameters will create ``sslendpoints`` binary in current +directory. + +Command (Docker) +~~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ make # or commands from corresponding "make" targets + + +Running +------- + +Command (local) +~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ bin/sslendpoints [-kubeconfig KUBECONFIG] [-xfail XFAIL] + +Command (Docker) +~~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ docker run --rm --volume $KUBECONFIG:/.kube/config \ + sslendpoints-build-img /bin/sslendpoints + + $ docker run --rm --volume $KUBECONFIG:/opt/config \ + sslendpoints-build-img /bin/sslendpoints -kubeconfig /opt/config + + $ docker run --rm \ + --volume $KUBECONFIG:/opt/config \ + --volume $XFAIL:/opt/xfail \ + sslendpoints-build-img /bin/sslendpoints \ + -kubeconfig /opt/config + -xfail /opt/xfail + +Output +~~~~~~ + +.. code-block:: shell + + $ ./sslendpoints -kubeconfig ~/.kube/config.onap + 2020/03/17 10:40:29 Host 192.168.2.10 + 2020/03/17 10:40:29 PORT SERVICE + 2020/03/17 10:40:29 30203 sdnc-dgbuilder + 2020/03/17 10:40:29 30204 sdc-be + 2020/03/17 10:40:29 30207 sdc-fe + 2020/03/17 10:40:29 30220 aai-sparky-be + 2020/03/17 10:40:29 30226 message-router + 2020/03/17 10:40:29 30233 aai + 2020/03/17 10:40:29 30256 sdc-wfd-fe + 2020/03/17 10:40:29 30257 sdc-wfd-be + 2020/03/17 10:40:29 30264 sdc-dcae-fe + 2020/03/17 10:40:29 30266 sdc-dcae-dt + 2020/03/17 10:40:29 30279 aai-babel + 2020/03/17 10:40:29 30406 so-vnfm-adapter + 2020/03/17 10:40:29 There are 12 non-SSL NodePorts in the cluster + + +Testing +------- + +.. code-block:: shell + + $ go test ./... # basic + $ ginkgo -r # pretty + $ golangci-lint run # linters |