From 5de622a8247c4cf4fc2bd4e5f8a947e60a8c4bfb Mon Sep 17 00:00:00 2001
From: mrichomme <morgan.richomme@orange.com>
Date: Mon, 20 Apr 2020 14:50:27 +0200
Subject: Resync integration/xtesting repo

Issue-ID: INT-1366

Signed-off-by: mrichomme <morgan.richomme@orange.com>
Change-Id: I3af9c4697f0e67d3ce5b6d2fceeb978aeb20a0ff
---
 security/scripts/check_cis_kubernetes.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 security/scripts/check_cis_kubernetes.sh

(limited to 'security/scripts/check_cis_kubernetes.sh')

diff --git a/security/scripts/check_cis_kubernetes.sh b/security/scripts/check_cis_kubernetes.sh
new file mode 100644
index 0000000..33ffdf5
--- /dev/null
+++ b/security/scripts/check_cis_kubernetes.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+echo "------------------------------------------------------------------------"
+echo "--------------------  ONAP Security tests   ----------------------------"
+echo "-----------------  Test if K8S is CIS compliant   ----------------------"
+echo "------------------------------------------------------------------------"
+
+code=0
+
+CIS_VERSION=${CIS_VERSION:-1.4}
+echo "Running CIS test case version ${CIS_VERSION}"
+kube-bench master --benchmark cis-${CIS_VERSION} > cis_full_test.txt
+cat cis_full_test.txt | grep "\[FAIL]" > cisK8s.txt
+
+if [ -s cisK8s.txt ]
+then
+   code=1
+   nb_errors=`cat cisK8s.txt | wc -l`
+   echo "Test FAIL: $nb_errors assertions not passed"
+   cat cis_full_test.txt
+else
+  echo "Test PASS: Kubernetes Deployment is CIS compatible"
+fi
+
+exit $code
-- 
cgit 1.2.3-korg