From 0231bdbc69fd7a594606d88124a1a789963a49e7 Mon Sep 17 00:00:00 2001
From: Pawel Wieczorek
Date: Fri, 5 Jul 2019 14:34:34 +0200
Subject: k8s: Relax kublet HTTPS connection requirement
According to kube-apiserver documentation [1] and CIS guideline 1.1.4
option "--kubelet-https=" might be absent in API server configuration.
It has secure configuration (being set to "true") by default.
[1] https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
Issue-ID: SECCOM-235
Change-Id: I604cdcace03f65185aab6a0b34d48cfec94277ab
Signed-off-by: Pawel Wieczorek
---
test/security/k8s/src/check/validators/master/api.go | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
(limited to 'test/security/k8s/src/check/validators')
diff --git a/test/security/k8s/src/check/validators/master/api.go b/test/security/k8s/src/check/validators/master/api.go
index ac84d8f1c..c91b77e30 100644
--- a/test/security/k8s/src/check/validators/master/api.go
+++ b/test/security/k8s/src/check/validators/master/api.go
@@ -40,11 +40,6 @@ func IsAnonymousAuthDisabled(params []string) bool {
return hasSingleFlagArgument("--anonymous-auth=", "false", params)
}
-// IsKubeletHTTPSConnected validates there is single "--kubelet-https" flag and it is set to "true".
-func IsKubeletHTTPSConnected(params []string) bool {
- return hasSingleFlagArgument("--kubelet-https=", "true", params)
-}
-
// IsInsecurePortUnbound validates there is single "--insecure-port" flag and it is set to "0" (disabled).
func IsInsecurePortUnbound(params []string) bool {
return hasSingleFlagArgument("--insecure-port=", strconv.Itoa(portDisabled), params)
@@ -96,6 +91,12 @@ func splitKV(s, sep string) (string, string) {
return ret[0], ret[1]
}
+// IsKubeletHTTPSAbsentOrEnabled validates there is single "--kubelet-https" flag and it is set to "true".
+func IsKubeletHTTPSAbsentOrEnabled(params []string) bool {
+ return isFlagAbsent("--kubelet-https=", params) ||
+ hasSingleFlagArgument("--kubelet-https=", "true", params)
+}
+
// IsInsecureBindAddressAbsentOrLoopback validates there is no insecure bind address or it is loopback address.
func IsInsecureBindAddressAbsentOrLoopback(params []string) bool {
return isFlagAbsent("--insecure-bind-address=", params) ||
--
cgit 1.2.3-korg