kube_auto_analyzer 0.0.8 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 477ad0c2cb8e8a489cc6901f90534ef368b3baa1
-  data.tar.gz: ff57249d3d80cf7f62b86aa760eed5386765b4e0
+  metadata.gz: 074921cde562a30edcc22e129010ab6823d688ca
+  data.tar.gz: 4412d5f1123ce2c48a032a442110415a616cc165
 SHA512:
-  metadata.gz: 1628d35f5c38de533b99979d060f1cb18f70853c36a983c6bc16076f201fe675c3c4460d287bd90ddb0ef9c7c451fcfc694751e4d527190fe1342203fdef7368
-  data.tar.gz: 9550f88df01e83f67a24dc4b18b186186a9a7642187d80e67e7aa766fcf5cb3fb489711921d556dca6c86c2fb4705be953d28dabb78e66b4b9d69020dcba836a
+  metadata.gz: b5c474423ef3a59932bb5b8743465ef7a7ed2611c926ed322741e868c44491f18403023c96c913b39d269183624b346f4513c26910f488c5bc382ce00fb9a32f
+  data.tar.gz: a572a61904ebdd781ddb6bb77fbde2f143533b7d89ec79247c13c70a986a0e918a7470937a18c3885d5b8eb1a6daba0bd545fc3d555c60686b8b988425ada4b4

data/lib/kube_auto_analyzer/reporting.rb

@@ -189,6 +189,71 @@ module KubeAutoAnalyzer
     end
     @html_report_file.puts "</table>"
 
+    #Show what cluster authentication modes are supported.
+    @html_report_file.puts "<br><br>"
+    @html_report_file.puts "<br><br><h2>Kubernetes Authentication Options</h2>"
+    @html_report_file.puts "<table><thead><tr><th>Authentication Option</th><th>Enabled?</th></tr></thead>"
+    if @results[@options.target_server]['api_server']['CIS 1.1.2 - Ensure that the --basic-auth-file argument is not set'] == "Fail"
+      @html_report_file.puts "<tr><td>Basic Authentication</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Basic Authentication</td><td>Disabled</td></tr>"
+    end
+    if @results[@options.target_server]['api_server']['CIS 1.1.20 - Ensure that the --token-auth-file argument is not set'] == "Fail"
+      @html_report_file.puts "<tr><td>Token Authentication</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Token Authentication</td><td>Disabled</td></tr>"
+    end
+    if @results[@options.target_server]['api_server']['CIS 1.1.29 - Ensure that the --client-ca-file argument is set as appropriate'] == "Pass"
+      @html_report_file.puts "<tr><td>Client Certificate Authentication</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Client Certificate Authentication</td><td>Disabled</td></tr>"
+    end
+
+    if @results[@options.target_server]['evidence']['API Server'].index{|line| line =~ /--oidc-issuer-url/}
+      @html_report_file.puts "<tr><td>OpenID Connect Authentication</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>OpenID Connect Authentication</td><td>Disabled</td></tr>"
+    end
+
+    if @results[@options.target_server]['evidence']['API Server'].index{|line| line =~ /--authentication-token-webhook-config-file/}
+      @html_report_file.puts "<tr><td>Webhook Authentication</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Webhook Authentication</td><td>Disabled</td></tr>"
+    end
+
+    if @results[@options.target_server]['evidence']['API Server'].index{|line| line =~ /--requestheader-username-headers/}
+      @html_report_file.puts "<tr><td>Proxy Authentication</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Proxy Authentication</td><td>Disabled</td></tr>"
+    end
+
+    @html_report_file.puts "</table>"
+
+    #Show what cluster authorization modes are supported.
+    @html_report_file.puts "<br><br>"
+    @html_report_file.puts "<br><br><h2>Kubernetes Authorization Options</h2>"
+    @html_report_file.puts "<table><thead><tr><th>Authorization Option</th><th>Enabled?</th></tr></thead>"
+
+    if @results[@options.target_server]['evidence']['API Server'].index{|line| line =~ /--authorization-mode\S*RBAC/}
+      @html_report_file.puts "<tr><td>Role Based Authorization</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Role Based Authorization</td><td>Disabled</td></tr>"
+    end
+
+    if @results[@options.target_server]['evidence']['API Server'].index{|line| line =~ /--authorization-mode\S*ABAC/}
+      @html_report_file.puts "<tr><td>Attribute Based Authorization</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Attribute Based Authorization</td><td>Disabled</td></tr>"
+    end
+
+    if @results[@options.target_server]['evidence']['API Server'].index{|line| line =~ /--authorization-mode\S*Webhook/}
+      @html_report_file.puts "<tr><td>Webhook Authorization</td><td>Enabled</td></tr>"
+    else
+      @html_report_file.puts "<tr><td>Webhook Authorization</td><td>Disabled</td></tr>"
+    end
+
+    @html_report_file.puts "</table>"    
+
     @html_report_file.puts "<br><br><h2>Evidence</h2><br>"
     @html_report_file.puts "<table><thead><tr><th>Area</th><th>Output</th></tr></thead>"
     @results[@options.target_server]['evidence'].each do |area, output|

data/lib/kube_auto_analyzer/version.rb

@@ -1,3 +1,3 @@
 module KubeAutoAnalyzer
-  VERSION = "0.0.8"
+  VERSION = "0.0.9"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kube_auto_analyzer
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.0.9
 platform: ruby
 authors:
 - Rory McCune
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-03 00:00:00.000000000 Z
+date: 2017-11-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler