Age | Commit message (Collapse) | Author | Files | Lines |
|
This patch extends tool used to detect plain HTTP ports to report all
non-SSL endpoints. Previously it omitted services not recognized as
HTTP.
Naming changes were made to reflect purpose of this tool better.
Issue-ID: INT-1480
Change-Id: I58a152022d48121bf4b9c6180ddc820dd4a79805
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch is heavily based on previous work by
Morgan Richomme <morgan.richomme@orange.com>
(Change-Id: Ibaed4c5c0e5ae179af0ae317e543c1efdc9ddef2)
It is intended to suppress failure reports on known plain HTTP
endpoints. Introduced list of "expected failures" (or "xfail" for short)
will be shrunk after resolving tickets related to INT-1480 and this
patch will be eventually reverted.
Issue-ID: INT-1480
Change-Id: I4edbf3efaf66bfa2dbe2f265983eb0a27048ed4e
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
The port scanned can be the default redis port.
A white list must be included to avoid false positive.
Open quesiton, should this list be passed as argument?
It is relatively static so for the moment, I created a list to exclude
through grep -V the false positive
Issue-ID: INT-1435
Signed-off-by: mrichomme <morgan.richomme@orange.com>
Change-Id: Ibaed4c5c0e5ae179af0ae317e543c1efdc9ddef2
Signed-off-by: mrichomme <morgan.richomme@orange.com>
|
|
Change-Id: Ic0d2a32a964a4cf5ff1580ffd06103c450a0e8b0
Issue-ID: INT-1427
Signed-off-by: Bartek Grzybowski <b.grzybowski@partner.samsung.com>
|
|
Reported by pylint.
Change-Id: I9d5ee152f3587bb2d7e8abee919e4ffe47d8ae85
Issue-ID: INT-1427
Signed-off-by: Bartek Grzybowski <b.grzybowski@partner.samsung.com>
|
|
Change-Id: I77bcf667d4a639b001258d026f2633fce2bfb0e6
Signed-off-by: Bartek Grzybowski <b.grzybowski@partner.samsung.com>
Issue-ID: INT-1451
|
|
Casablanca release reached End of Life (EOL) stage on July 8th 2019 [1].
This patch also fixes comments for test fixtures.
This whole test subtree will be deleted upon migrating Aquasec
kube-bench [2] for CIS Benchmark [3] integrated by Orange [4] to ONAP
xtesting [5].
[1] https://wiki.onap.org/display/DW/Long+Term+Roadmap
[2] https://github.com/aquasecurity/kube-bench
[3] https://www.cisecurity.org/benchmark/kubernetes/
[4] https://gitlab.com/Orange-OpenSource/lfn/onap/integration/xtesting
[5] https://git.onap.org/integration/xtesting/
Issue-ID: SECCOM-235
Change-Id: Ifc7d9c775c27d4cfafdd1932809288530cffceff
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Information for etcd extracted from container on a RKE-based cluster
does not include process name.
Issue-ID: SECCOM-235
Change-Id: Ie6aee550868431d5f4d27c3b3d262e17e1aa6156
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Rancher does not provide information on etcd as container arguments.
Its collection requires implementation of a new information extraction
method.
RKE does not include etcd process name in container arguments.
Issue-ID: SECCOM-235
Change-Id: I7576474fb2848962360771d2850aeb3f3869790a
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections
regarding master node configuration are satisfied (1.3.1 and 1.3.4 -
1.3.5).
Issue-ID: SECCOM-235
Change-Id: I418034ea98423142f4875b97a8e6a22e8b4cd112
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch also fixes minor typo.
Issue-ID: SECCOM-261
Change-Id: I4326106f14381ec652eb493bf0a87fb1d82ea3fb
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This tool reads K8S NodePort and Ingress service configurations
and scans for service availability
Signed-off-by: Lucjan Bryndza <l.bryndza@samsung.com>
Change-Id: Ie9681ffe957317ed1f1c77ac9d6c90d677df294b
Issue-ID: OOM-2240
Signed-off-by: Lucjan Bryndza <l.bryndza@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections
regarding master node configuration are satisfied (1.3.2 - 1.3.3
and 1.3.6).
Issue-ID: SECCOM-235
Change-Id: I9c2921faf40ad9445e983f2b9bd0610e556cfe15
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Checker collects information on cluster by Docker queries:
$ docker ps ARGS... # Casablanca
$ docker inspect ARGS... # Dublin
Arrays of values are then filtered from those. They include:
* opening bracket ('['),
* closing bracket (']'),
* new line.
Additional characters affect check results if last flag (including
"]\n") requires specific value.
Issue-ID: SECCOM-235
Change-Id: I6838342b7e2ecdc44a47ffe02286266003e0b4d3
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Running Casablanca and Dublin virtual environments at the same time led
to networking issues - the same IP had been assigned to cluster nodes.
Issue-ID: SECCOM-235
Change-Id: I2a59d023115326f5b132782a32190fd8f7dc1f48
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.3.7).
Issue-ID: SECCOM-235
Change-Id: Id3f4bcb9a506dae3c7c0a884ad6c704dfae2a6d8
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: Ieceb6337f935e6a5a6b94248ccf072229116510a
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I61df142e99a7f1da335471acab88e5a47d72df15
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I7da645737440172d3cf11f33069daa2697f83056
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: Ic5997b67d0512bea51c3b4a4c71805987fa6f011
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Common command and service name extraction is intended to limit
execution to small set of allowed processes.
This patch also drops unnecessary use of "Kubernetes" name because this
whole subproject concerns its clusters.
Issue-ID: SECCOM-235
Change-Id: I8babfeb4f24cf3baa4d236ca622c21170ab6205e
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Previous way of choosing it led to impractical calls, e.g.
$ ./check -rke # (works fine)
$ ./check -ranchercli # "Not supported."
$ ./check -ranchercli -rke=false # (works fine)
Disabling default cluster access method is no longer necessary.
Issue-ID: SECCOM-235
Change-Id: I2b4d5bff10c5470e567351abeac0431bed3b7938
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I7d4efd08b8c0258f2f9c33772bf1b1b02cedebfa
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: Ia5d75628b1c5211f378c239f84e9689d45697a04
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.38).
Issue-ID: SECCOM-235
Change-Id: Ic1f175d577c79013ddb49e02b8de69137535c964
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.32).
It also fixes wrong documentation comment for similar validator
(1.1.19).
Issue-ID: SECCOM-235
Change-Id: I00cb8a458871b091b16fe60fc0087b7972aa3b6b
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.30).
It also covers its duplicate (1.1.39).
Issue-ID: SECCOM-235
Change-Id: I0f3031c080cf225e7c2c03e65dd0bfc780326307
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections
regarding master node configuration are satisfied (1.1.22, 1.1.25 -
1.1.26 and 1.1.28).
Issue-ID: SECCOM-235
Change-Id: Ic61a796653dc868d20fe69c3ed508e7fa8ba52db
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections
regarding master node configuration are satisfied (1.1.21, 1.1.29
and 1.1.31).
Issue-ID: SECCOM-235
Change-Id: Ia2f55f6962885a7aa878c970a406189902cfab10
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections
regarding master node configuration are satisfied (1.1.16 - 1.1.18).
Issue-ID: SECCOM-235
Change-Id: I27b63e37fc3203cf3574b9e1cdc43333041f2a36
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.15).
Issue-ID: SECCOM-235
Change-Id: Ia1d27ed7a9e439bb0abf4bd8941bdd4573a50bd5
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I25ebd2930afec6eb259f0a678fffbf7727eb315b
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.19).
Issue-ID: SECCOM-235
Change-Id: I00c9600fd0d351afb7141a5fa16f348eab67b12d
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.14).
Issue-ID: SECCOM-235
Change-Id: I63c2f8a5b94bfd6c9963805aae85595e6b6ad6d7
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections
regarding master node configuration are satisfied (1.1.11 - 1.1.13,
1.1.24, 1.1.27, 1.1.33 and 1.1.36).
Issue-ID: SECCOM-235
Change-Id: I920bfd42014b8458126be251648f5bf3dcd84c16
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch verifies if CIS Kubernetes Benchmark v1.3.0 section
regarding master node configuration is satisfied (1.1.10).
However, CIS Kubernetes Benchmark v1.3.0 mismatches official
documentation: Kubernetes 1.10+ already provides safe defaults from
security standpoint [1] (ONAP Casablanca uses 1.11).
Deprecated admission control plugin flag has also been validated since
it was still available in Kubernetes provided by Rancher [2].
[1] https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use
[2] https://github.com/rancher/rancher/issues/15064
Issue-ID: SECCOM-235
Change-Id: I0e8fe9f885861f155cb8265df085fa93dbdff6d2
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I35d3e3f413542c69718d17ae25f227275270c8cf
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I6ac5f3c160f1cd1d8faac90576ab943d4ed213a5
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Building "check" binary now requires several external dependencies. To
minimize setup effort, convenience make targets were provided.
Issue-ID: SECCOM-235
Change-Id: Iec74c0652a5ed3a90d4504216b00ef20bdb7e81f
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
RKE is used as a Kubernetes cluster deployment method from ONAP Dublin
release. RKE cluster definition is used to get access to necessary
information.
Issue-ID: SECCOM-235
Change-Id: I588598011ea746b5f7ba327a48f1cea605e56d31
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: Ie6d43b9db767f191f883a2912916bc8abf9d3ad6
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
So far CIS-compliant configuration has been validated first unless
configuration used in ONAP release did not pass given benchmark.
Issue-ID: SECCOM-235
Change-Id: Ibdb523ab7ab6b8285757719721f75aca57beeb82
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch uses previously added alias for kubectl context switching in
case it is needed as a template for other contexts as well.
Issue-ID: SECCOM-235
Change-Id: Ie92641ee3763a027cd74dd21bf4364a2d796eb1d
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch sets debconf frontend to noninteractive by including
additional field in the first stanza of configuration file. Its
placement has been chosen arbitrarily - both 'Config' and 'Templates'
fields "are required in this first stanza" [1].
It also makes symlinking script more generic.
[1] man 5 debconf.conf (provided by "debconf-doc" in Ubuntu)
Issue-ID: SECCOM-235
Change-Id: If9dcc712d1ff7f527d3bc59f4c1709cffe4cbda5
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Setting up kubectl depends on presence of K8s cluster post-deployment
artifacts, hence it's disabled by default. Relevant information added to
post-up message.
This patch also removes unneeded curly braces from
"tools/dublin/get_rke.sh" script.
Issue-ID: SECCOM-235
Change-Id: I917ebbda588639f0941e16c65759430a7a1e64ff
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I9913d9a8f525b4b9582bf821008dd567258a719c
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I8f9d4362da50a8b3f2aa1baf3633d818da2ed3a5
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This patch adds sample cluster.yml which is based on Dublin cluster
configuration file [1]. Main difference is in avoiding repetition by
using anchors and alias nodes.
Actual cluster creation provisioner is disabled by default because
'control' and 'worker' nodes might not be ready yet.
[1] https://docs.onap.org/en/dublin/_downloads/27934fe702048777f312d77dc30cd05a/cluster.yml
Issue-ID: SECCOM-235
Change-Id: Ibba0e754ba87e334cdaa61de83e48107f91083d9
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
Issue-ID: SECCOM-235
Change-Id: I85efb88476cb1d6bfaee44b6bcd6275477e77ba5
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|
|
This not only makes testing easier, but also allows better control over
VM provisioning after its creation.
Issue-ID: SECCOM-235
Change-Id: I29ab3ed46976267e1043c2f61f56578f2c5d7a57
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
|