@sagentix-inc/evidence-collector 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +478 -464
- package/apps/sos-app/src/data/checks/prowler_azure.json +137 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_gcp.json +99 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +75 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +69 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +2 -2
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +1 -1
- package/package.json +1 -1
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: Kubernetes (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"ClusterRole prowler-read-cluster: get, list, watch on pods, configmaps, nodes, namespaces, clusterrolebindings, rolebindings, clusterroles, roles (kubernetes/prowler-role.yaml)"
|
|
6
6
|
],
|
|
7
7
|
"engine": {
|
|
8
8
|
"name": "Prowler",
|
|
9
|
-
"version": "5.
|
|
9
|
+
"version": "5.47.0",
|
|
10
10
|
"licence": "Apache-2.0",
|
|
11
11
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
12
12
|
},
|
|
@@ -15,511 +15,511 @@
|
|
|
15
15
|
{
|
|
16
16
|
"id": "prowler.kubernetes.apiserver_always_pull_images_plugin",
|
|
17
17
|
"title": "API server pod has AlwaysPullImages admission control plugin enabled",
|
|
18
|
-
"scope": "Prowler 5.
|
|
18
|
+
"scope": "Prowler 5.47.0 check apiserver_always_pull_images_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
19
19
|
"evidenceType": "Configuration",
|
|
20
20
|
"severity": "medium"
|
|
21
21
|
},
|
|
22
22
|
{
|
|
23
23
|
"id": "prowler.kubernetes.apiserver_anonymous_requests",
|
|
24
24
|
"title": "API server pod has anonymous-auth disabled",
|
|
25
|
-
"scope": "Prowler 5.
|
|
25
|
+
"scope": "Prowler 5.47.0 check apiserver_anonymous_requests (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
26
26
|
"evidenceType": "Configuration",
|
|
27
27
|
"severity": "high"
|
|
28
28
|
},
|
|
29
29
|
{
|
|
30
30
|
"id": "prowler.kubernetes.apiserver_audit_log_maxage_set",
|
|
31
31
|
"title": "API server pod has --audit-log-maxage set to 30 (or the cluster-configured value)",
|
|
32
|
-
"scope": "Prowler 5.
|
|
32
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_maxage_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
33
33
|
"evidenceType": "Configuration",
|
|
34
34
|
"severity": "medium"
|
|
35
35
|
},
|
|
36
36
|
{
|
|
37
37
|
"id": "prowler.kubernetes.apiserver_audit_log_maxbackup_set",
|
|
38
38
|
"title": "API server pod has --audit-log-maxbackup set to 10 or the configured value",
|
|
39
|
-
"scope": "Prowler 5.
|
|
39
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_maxbackup_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
40
40
|
"evidenceType": "Configuration",
|
|
41
41
|
"severity": "medium"
|
|
42
42
|
},
|
|
43
43
|
{
|
|
44
44
|
"id": "prowler.kubernetes.apiserver_audit_log_maxsize_set",
|
|
45
45
|
"title": "API server pod has --audit-log-maxsize set to 100 MB or the configured value",
|
|
46
|
-
"scope": "Prowler 5.
|
|
46
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_maxsize_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
47
47
|
"evidenceType": "Configuration",
|
|
48
48
|
"severity": "medium"
|
|
49
49
|
},
|
|
50
50
|
{
|
|
51
51
|
"id": "prowler.kubernetes.apiserver_audit_log_path_set",
|
|
52
52
|
"title": "API server pod has --audit-log-path set",
|
|
53
|
-
"scope": "Prowler 5.
|
|
53
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_path_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
54
54
|
"evidenceType": "Configuration",
|
|
55
55
|
"severity": "high"
|
|
56
56
|
},
|
|
57
57
|
{
|
|
58
58
|
"id": "prowler.kubernetes.apiserver_auth_mode_include_node",
|
|
59
59
|
"title": "API server pod has Node in --authorization-mode",
|
|
60
|
-
"scope": "Prowler 5.
|
|
60
|
+
"scope": "Prowler 5.47.0 check apiserver_auth_mode_include_node (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
61
61
|
"evidenceType": "Configuration",
|
|
62
62
|
"severity": "high"
|
|
63
63
|
},
|
|
64
64
|
{
|
|
65
65
|
"id": "prowler.kubernetes.apiserver_auth_mode_include_rbac",
|
|
66
66
|
"title": "API server pod authorization mode includes RBAC",
|
|
67
|
-
"scope": "Prowler 5.
|
|
67
|
+
"scope": "Prowler 5.47.0 check apiserver_auth_mode_include_rbac (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
68
68
|
"evidenceType": "Configuration",
|
|
69
69
|
"severity": "high"
|
|
70
70
|
},
|
|
71
71
|
{
|
|
72
72
|
"id": "prowler.kubernetes.apiserver_auth_mode_not_always_allow",
|
|
73
73
|
"title": "API server pod does not use the AlwaysAllow authorization mode",
|
|
74
|
-
"scope": "Prowler 5.
|
|
74
|
+
"scope": "Prowler 5.47.0 check apiserver_auth_mode_not_always_allow (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
75
75
|
"evidenceType": "Configuration",
|
|
76
76
|
"severity": "critical"
|
|
77
77
|
},
|
|
78
78
|
{
|
|
79
79
|
"id": "prowler.kubernetes.apiserver_client_ca_file_set",
|
|
80
80
|
"title": "API server pod has the --client-ca-file argument set",
|
|
81
|
-
"scope": "Prowler 5.
|
|
81
|
+
"scope": "Prowler 5.47.0 check apiserver_client_ca_file_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
82
82
|
"evidenceType": "Configuration",
|
|
83
83
|
"severity": "high"
|
|
84
84
|
},
|
|
85
85
|
{
|
|
86
86
|
"id": "prowler.kubernetes.apiserver_deny_service_external_ips",
|
|
87
87
|
"title": "API server pod has DenyServiceExternalIPs admission controller enabled",
|
|
88
|
-
"scope": "Prowler 5.
|
|
88
|
+
"scope": "Prowler 5.47.0 check apiserver_deny_service_external_ips (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
89
89
|
"evidenceType": "Configuration",
|
|
90
90
|
"severity": "high"
|
|
91
91
|
},
|
|
92
92
|
{
|
|
93
93
|
"id": "prowler.kubernetes.apiserver_disable_profiling",
|
|
94
94
|
"title": "API server pod has profiling disabled (--profiling=false)",
|
|
95
|
-
"scope": "Prowler 5.
|
|
95
|
+
"scope": "Prowler 5.47.0 check apiserver_disable_profiling (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
96
96
|
"evidenceType": "Configuration",
|
|
97
97
|
"severity": "medium"
|
|
98
98
|
},
|
|
99
99
|
{
|
|
100
100
|
"id": "prowler.kubernetes.apiserver_encryption_provider_config_set",
|
|
101
101
|
"title": "API server pod has the --encryption-provider-config argument set",
|
|
102
|
-
"scope": "Prowler 5.
|
|
102
|
+
"scope": "Prowler 5.47.0 check apiserver_encryption_provider_config_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
103
103
|
"evidenceType": "Configuration",
|
|
104
104
|
"severity": "high"
|
|
105
105
|
},
|
|
106
106
|
{
|
|
107
107
|
"id": "prowler.kubernetes.apiserver_etcd_cafile_set",
|
|
108
108
|
"title": "API server pod has the --etcd-cafile argument set",
|
|
109
|
-
"scope": "Prowler 5.
|
|
109
|
+
"scope": "Prowler 5.47.0 check apiserver_etcd_cafile_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
110
110
|
"evidenceType": "Configuration",
|
|
111
111
|
"severity": "critical"
|
|
112
112
|
},
|
|
113
113
|
{
|
|
114
114
|
"id": "prowler.kubernetes.apiserver_etcd_tls_config",
|
|
115
115
|
"title": "API server pod has --etcd-certfile and --etcd-keyfile configured for etcd TLS",
|
|
116
|
-
"scope": "Prowler 5.
|
|
116
|
+
"scope": "Prowler 5.47.0 check apiserver_etcd_tls_config (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
117
117
|
"evidenceType": "Configuration",
|
|
118
118
|
"severity": "critical"
|
|
119
119
|
},
|
|
120
120
|
{
|
|
121
121
|
"id": "prowler.kubernetes.apiserver_event_rate_limit",
|
|
122
122
|
"title": "API server pod has the EventRateLimit admission control plugin enabled",
|
|
123
|
-
"scope": "Prowler 5.
|
|
123
|
+
"scope": "Prowler 5.47.0 check apiserver_event_rate_limit (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
124
124
|
"evidenceType": "Configuration",
|
|
125
125
|
"severity": "medium"
|
|
126
126
|
},
|
|
127
127
|
{
|
|
128
128
|
"id": "prowler.kubernetes.apiserver_kubelet_cert_auth",
|
|
129
129
|
"title": "API server pod has --kubelet-certificate-authority configured",
|
|
130
|
-
"scope": "Prowler 5.
|
|
130
|
+
"scope": "Prowler 5.47.0 check apiserver_kubelet_cert_auth (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
131
131
|
"evidenceType": "Configuration",
|
|
132
132
|
"severity": "critical"
|
|
133
133
|
},
|
|
134
134
|
{
|
|
135
135
|
"id": "prowler.kubernetes.apiserver_kubelet_tls_auth",
|
|
136
136
|
"title": "API server pod has --kubelet-client-certificate and --kubelet-client-key arguments configured",
|
|
137
|
-
"scope": "Prowler 5.
|
|
137
|
+
"scope": "Prowler 5.47.0 check apiserver_kubelet_tls_auth (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
138
138
|
"evidenceType": "Configuration",
|
|
139
139
|
"severity": "critical"
|
|
140
140
|
},
|
|
141
141
|
{
|
|
142
142
|
"id": "prowler.kubernetes.apiserver_namespace_lifecycle_plugin",
|
|
143
143
|
"title": "API server pod has NamespaceLifecycle admission control plugin enabled",
|
|
144
|
-
"scope": "Prowler 5.
|
|
144
|
+
"scope": "Prowler 5.47.0 check apiserver_namespace_lifecycle_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
145
145
|
"evidenceType": "Configuration",
|
|
146
146
|
"severity": "high"
|
|
147
147
|
},
|
|
148
148
|
{
|
|
149
149
|
"id": "prowler.kubernetes.apiserver_no_always_admit_plugin",
|
|
150
150
|
"title": "API server pod does not have the AlwaysAdmit admission control plugin enabled",
|
|
151
|
-
"scope": "Prowler 5.
|
|
151
|
+
"scope": "Prowler 5.47.0 check apiserver_no_always_admit_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
152
152
|
"evidenceType": "Configuration",
|
|
153
153
|
"severity": "critical"
|
|
154
154
|
},
|
|
155
155
|
{
|
|
156
156
|
"id": "prowler.kubernetes.apiserver_no_token_auth_file",
|
|
157
157
|
"title": "API server pod does not have --token-auth-file enabled",
|
|
158
|
-
"scope": "Prowler 5.
|
|
158
|
+
"scope": "Prowler 5.47.0 check apiserver_no_token_auth_file (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
159
159
|
"evidenceType": "Configuration",
|
|
160
160
|
"severity": "high"
|
|
161
161
|
},
|
|
162
162
|
{
|
|
163
163
|
"id": "prowler.kubernetes.apiserver_node_restriction_plugin",
|
|
164
164
|
"title": "API server pod has NodeRestriction admission control plugin enabled",
|
|
165
|
-
"scope": "Prowler 5.
|
|
165
|
+
"scope": "Prowler 5.47.0 check apiserver_node_restriction_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
166
166
|
"evidenceType": "Configuration",
|
|
167
167
|
"severity": "high"
|
|
168
168
|
},
|
|
169
169
|
{
|
|
170
170
|
"id": "prowler.kubernetes.apiserver_request_timeout_set",
|
|
171
171
|
"title": "API server pod has --request-timeout configured",
|
|
172
|
-
"scope": "Prowler 5.
|
|
172
|
+
"scope": "Prowler 5.47.0 check apiserver_request_timeout_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
173
173
|
"evidenceType": "Configuration",
|
|
174
174
|
"severity": "medium"
|
|
175
175
|
},
|
|
176
176
|
{
|
|
177
177
|
"id": "prowler.kubernetes.apiserver_security_context_deny_plugin",
|
|
178
178
|
"title": "API server pod uses PodSecurityPolicy or has the SecurityContextDeny admission plugin enabled",
|
|
179
|
-
"scope": "Prowler 5.
|
|
179
|
+
"scope": "Prowler 5.47.0 check apiserver_security_context_deny_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
180
180
|
"evidenceType": "Configuration",
|
|
181
181
|
"severity": "high"
|
|
182
182
|
},
|
|
183
183
|
{
|
|
184
184
|
"id": "prowler.kubernetes.apiserver_service_account_key_file_set",
|
|
185
185
|
"title": "API server pod has --service-account-key-file configured",
|
|
186
|
-
"scope": "Prowler 5.
|
|
186
|
+
"scope": "Prowler 5.47.0 check apiserver_service_account_key_file_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
187
187
|
"evidenceType": "Configuration",
|
|
188
188
|
"severity": "high"
|
|
189
189
|
},
|
|
190
190
|
{
|
|
191
191
|
"id": "prowler.kubernetes.apiserver_service_account_lookup_true",
|
|
192
192
|
"title": "API server pod has --service-account-lookup set to true",
|
|
193
|
-
"scope": "Prowler 5.
|
|
193
|
+
"scope": "Prowler 5.47.0 check apiserver_service_account_lookup_true (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
194
194
|
"evidenceType": "Configuration",
|
|
195
195
|
"severity": "high"
|
|
196
196
|
},
|
|
197
197
|
{
|
|
198
198
|
"id": "prowler.kubernetes.apiserver_service_account_plugin",
|
|
199
199
|
"title": "API server pod has ServiceAccount admission control plugin enabled",
|
|
200
|
-
"scope": "Prowler 5.
|
|
200
|
+
"scope": "Prowler 5.47.0 check apiserver_service_account_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
201
201
|
"evidenceType": "Configuration",
|
|
202
202
|
"severity": "high"
|
|
203
203
|
},
|
|
204
204
|
{
|
|
205
205
|
"id": "prowler.kubernetes.apiserver_tls_config",
|
|
206
206
|
"title": "API server pod has --tls-cert-file and --tls-private-key-file configured",
|
|
207
|
-
"scope": "Prowler 5.
|
|
207
|
+
"scope": "Prowler 5.47.0 check apiserver_tls_config (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
208
208
|
"evidenceType": "Configuration",
|
|
209
209
|
"severity": "high"
|
|
210
210
|
},
|
|
211
211
|
{
|
|
212
212
|
"id": "prowler.kubernetes.controllermanager_bind_address",
|
|
213
213
|
"title": "Controller Manager pod is bound to the loopback address 127.0.0.1",
|
|
214
|
-
"scope": "Prowler 5.
|
|
214
|
+
"scope": "Prowler 5.47.0 check controllermanager_bind_address (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
215
215
|
"evidenceType": "Configuration",
|
|
216
216
|
"severity": "high"
|
|
217
217
|
},
|
|
218
218
|
{
|
|
219
219
|
"id": "prowler.kubernetes.controllermanager_disable_profiling",
|
|
220
220
|
"title": "Controller Manager pod has --profiling=false configured",
|
|
221
|
-
"scope": "Prowler 5.
|
|
221
|
+
"scope": "Prowler 5.47.0 check controllermanager_disable_profiling (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
222
222
|
"evidenceType": "Configuration",
|
|
223
223
|
"severity": "medium"
|
|
224
224
|
},
|
|
225
225
|
{
|
|
226
226
|
"id": "prowler.kubernetes.controllermanager_root_ca_file_set",
|
|
227
227
|
"title": "Controller Manager pod has --root-ca-file argument set",
|
|
228
|
-
"scope": "Prowler 5.
|
|
228
|
+
"scope": "Prowler 5.47.0 check controllermanager_root_ca_file_set (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
229
229
|
"evidenceType": "Configuration",
|
|
230
230
|
"severity": "critical"
|
|
231
231
|
},
|
|
232
232
|
{
|
|
233
233
|
"id": "prowler.kubernetes.controllermanager_rotate_kubelet_server_cert",
|
|
234
234
|
"title": "Controller Manager pod has RotateKubeletServerCertificate set to true",
|
|
235
|
-
"scope": "Prowler 5.
|
|
235
|
+
"scope": "Prowler 5.47.0 check controllermanager_rotate_kubelet_server_cert (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
236
236
|
"evidenceType": "Configuration",
|
|
237
237
|
"severity": "medium"
|
|
238
238
|
},
|
|
239
239
|
{
|
|
240
240
|
"id": "prowler.kubernetes.controllermanager_service_account_credentials",
|
|
241
241
|
"title": "Controller Manager pod has --use-service-account-credentials=true",
|
|
242
|
-
"scope": "Prowler 5.
|
|
242
|
+
"scope": "Prowler 5.47.0 check controllermanager_service_account_credentials (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
243
243
|
"evidenceType": "Configuration",
|
|
244
244
|
"severity": "high"
|
|
245
245
|
},
|
|
246
246
|
{
|
|
247
247
|
"id": "prowler.kubernetes.controllermanager_service_account_private_key_file",
|
|
248
248
|
"title": "Controller Manager pod has the --service-account-private-key-file argument set",
|
|
249
|
-
"scope": "Prowler 5.
|
|
249
|
+
"scope": "Prowler 5.47.0 check controllermanager_service_account_private_key_file (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
250
250
|
"evidenceType": "Configuration",
|
|
251
251
|
"severity": "high"
|
|
252
252
|
},
|
|
253
253
|
{
|
|
254
254
|
"id": "prowler.kubernetes.core_cpu_limits_set",
|
|
255
255
|
"title": "Pod containers have CPU limits set",
|
|
256
|
-
"scope": "Prowler 5.
|
|
256
|
+
"scope": "Prowler 5.47.0 check core_cpu_limits_set (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
257
257
|
"evidenceType": "Configuration",
|
|
258
258
|
"severity": "medium"
|
|
259
259
|
},
|
|
260
260
|
{
|
|
261
261
|
"id": "prowler.kubernetes.core_image_tag_fixed",
|
|
262
262
|
"title": "Container images use fixed tags",
|
|
263
|
-
"scope": "Prowler 5.
|
|
263
|
+
"scope": "Prowler 5.47.0 check core_image_tag_fixed (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
264
264
|
"evidenceType": "Configuration",
|
|
265
265
|
"severity": "medium"
|
|
266
266
|
},
|
|
267
267
|
{
|
|
268
268
|
"id": "prowler.kubernetes.core_liveness_probe_configured",
|
|
269
269
|
"title": "Pod containers have liveness probes configured",
|
|
270
|
-
"scope": "Prowler 5.
|
|
270
|
+
"scope": "Prowler 5.47.0 check core_liveness_probe_configured (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
271
271
|
"evidenceType": "Configuration",
|
|
272
272
|
"severity": "medium"
|
|
273
273
|
},
|
|
274
274
|
{
|
|
275
275
|
"id": "prowler.kubernetes.core_memory_limits_set",
|
|
276
276
|
"title": "Container memory limits are configured",
|
|
277
|
-
"scope": "Prowler 5.
|
|
277
|
+
"scope": "Prowler 5.47.0 check core_memory_limits_set (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
278
278
|
"evidenceType": "Configuration",
|
|
279
279
|
"severity": "medium"
|
|
280
280
|
},
|
|
281
281
|
{
|
|
282
282
|
"id": "prowler.kubernetes.core_minimize_admission_hostport_containers",
|
|
283
283
|
"title": "Pod does not use HostPorts",
|
|
284
|
-
"scope": "Prowler 5.
|
|
284
|
+
"scope": "Prowler 5.47.0 check core_minimize_admission_hostport_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
285
285
|
"evidenceType": "Configuration",
|
|
286
286
|
"severity": "high"
|
|
287
287
|
},
|
|
288
288
|
{
|
|
289
289
|
"id": "prowler.kubernetes.core_minimize_admission_windows_hostprocess_containers",
|
|
290
290
|
"title": "Pod does not allow Windows HostProcess containers",
|
|
291
|
-
"scope": "Prowler 5.
|
|
291
|
+
"scope": "Prowler 5.47.0 check core_minimize_admission_windows_hostprocess_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
292
292
|
"evidenceType": "Configuration",
|
|
293
293
|
"severity": "high"
|
|
294
294
|
},
|
|
295
295
|
{
|
|
296
296
|
"id": "prowler.kubernetes.core_minimize_allowPrivilegeEscalation_containers",
|
|
297
297
|
"title": "Pod does not allow privilege escalation in any container",
|
|
298
|
-
"scope": "Prowler 5.
|
|
298
|
+
"scope": "Prowler 5.47.0 check core_minimize_allowPrivilegeEscalation_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
299
299
|
"evidenceType": "Configuration",
|
|
300
300
|
"severity": "high"
|
|
301
301
|
},
|
|
302
302
|
{
|
|
303
303
|
"id": "prowler.kubernetes.core_minimize_containers_added_capabilities",
|
|
304
304
|
"title": "Pod has no containers with added capabilities",
|
|
305
|
-
"scope": "Prowler 5.
|
|
305
|
+
"scope": "Prowler 5.47.0 check core_minimize_containers_added_capabilities (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
306
306
|
"evidenceType": "Configuration",
|
|
307
307
|
"severity": "high"
|
|
308
308
|
},
|
|
309
309
|
{
|
|
310
310
|
"id": "prowler.kubernetes.core_minimize_containers_capabilities_assigned",
|
|
311
311
|
"title": "Pod containers have no added Linux capabilities and include capability drops when capabilities are defined",
|
|
312
|
-
"scope": "Prowler 5.
|
|
312
|
+
"scope": "Prowler 5.47.0 check core_minimize_containers_capabilities_assigned (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
313
313
|
"evidenceType": "Configuration",
|
|
314
314
|
"severity": "high"
|
|
315
315
|
},
|
|
316
316
|
{
|
|
317
317
|
"id": "prowler.kubernetes.core_minimize_hostNetwork_containers",
|
|
318
318
|
"title": "Pod does not use hostNetwork",
|
|
319
|
-
"scope": "Prowler 5.
|
|
319
|
+
"scope": "Prowler 5.47.0 check core_minimize_hostNetwork_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
320
320
|
"evidenceType": "Configuration",
|
|
321
321
|
"severity": "high"
|
|
322
322
|
},
|
|
323
323
|
{
|
|
324
324
|
"id": "prowler.kubernetes.core_minimize_hostpath_volume_mounts",
|
|
325
325
|
"title": "Pod does not use hostPath volumes",
|
|
326
|
-
"scope": "Prowler 5.
|
|
326
|
+
"scope": "Prowler 5.47.0 check core_minimize_hostpath_volume_mounts (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
327
327
|
"evidenceType": "Configuration",
|
|
328
328
|
"severity": "high"
|
|
329
329
|
},
|
|
330
330
|
{
|
|
331
331
|
"id": "prowler.kubernetes.core_minimize_net_raw_capability_admission",
|
|
332
332
|
"title": "Pod containers do not have the NET_RAW capability",
|
|
333
|
-
"scope": "Prowler 5.
|
|
333
|
+
"scope": "Prowler 5.47.0 check core_minimize_net_raw_capability_admission (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
334
334
|
"evidenceType": "Configuration",
|
|
335
335
|
"severity": "high"
|
|
336
336
|
},
|
|
337
337
|
{
|
|
338
338
|
"id": "prowler.kubernetes.core_minimize_privileged_containers",
|
|
339
339
|
"title": "Pod does not contain a privileged container",
|
|
340
|
-
"scope": "Prowler 5.
|
|
340
|
+
"scope": "Prowler 5.47.0 check core_minimize_privileged_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
341
341
|
"evidenceType": "Configuration",
|
|
342
342
|
"severity": "high"
|
|
343
343
|
},
|
|
344
344
|
{
|
|
345
345
|
"id": "prowler.kubernetes.core_minimize_root_containers_admission",
|
|
346
346
|
"title": "Pod does not run any container as the root user",
|
|
347
|
-
"scope": "Prowler 5.
|
|
347
|
+
"scope": "Prowler 5.47.0 check core_minimize_root_containers_admission (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
348
348
|
"evidenceType": "Configuration",
|
|
349
349
|
"severity": "high"
|
|
350
350
|
},
|
|
351
351
|
{
|
|
352
352
|
"id": "prowler.kubernetes.core_readiness_probe_configured",
|
|
353
353
|
"title": "Regular pod containers have readiness probes configured",
|
|
354
|
-
"scope": "Prowler 5.
|
|
354
|
+
"scope": "Prowler 5.47.0 check core_readiness_probe_configured (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
355
355
|
"evidenceType": "Configuration",
|
|
356
356
|
"severity": "medium"
|
|
357
357
|
},
|
|
358
358
|
{
|
|
359
359
|
"id": "prowler.kubernetes.core_readonly_root_filesystem_enabled",
|
|
360
360
|
"title": "Containers should run with a read-only root filesystem",
|
|
361
|
-
"scope": "Prowler 5.
|
|
361
|
+
"scope": "Prowler 5.47.0 check core_readonly_root_filesystem_enabled (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
362
362
|
"evidenceType": "Configuration",
|
|
363
363
|
"severity": "medium"
|
|
364
364
|
},
|
|
365
365
|
{
|
|
366
366
|
"id": "prowler.kubernetes.etcd_client_cert_auth",
|
|
367
367
|
"title": "Etcd pod has client certificate authentication enabled (--client-cert-auth=true)",
|
|
368
|
-
"scope": "Prowler 5.
|
|
368
|
+
"scope": "Prowler 5.47.0 check etcd_client_cert_auth (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
369
369
|
"evidenceType": "Configuration",
|
|
370
370
|
"severity": "high"
|
|
371
371
|
},
|
|
372
372
|
{
|
|
373
373
|
"id": "prowler.kubernetes.etcd_no_auto_tls",
|
|
374
374
|
"title": "Etcd pod has --auto-tls disabled",
|
|
375
|
-
"scope": "Prowler 5.
|
|
375
|
+
"scope": "Prowler 5.47.0 check etcd_no_auto_tls (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
376
376
|
"evidenceType": "Configuration",
|
|
377
377
|
"severity": "high"
|
|
378
378
|
},
|
|
379
379
|
{
|
|
380
380
|
"id": "prowler.kubernetes.etcd_no_peer_auto_tls",
|
|
381
381
|
"title": "Etcd pod does not use automatically generated self-signed certificates for peer TLS connections",
|
|
382
|
-
"scope": "Prowler 5.
|
|
382
|
+
"scope": "Prowler 5.47.0 check etcd_no_peer_auto_tls (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
383
383
|
"evidenceType": "Configuration",
|
|
384
384
|
"severity": "high"
|
|
385
385
|
},
|
|
386
386
|
{
|
|
387
387
|
"id": "prowler.kubernetes.etcd_peer_client_cert_auth",
|
|
388
388
|
"title": "Etcd pod has peer client certificate authentication enabled",
|
|
389
|
-
"scope": "Prowler 5.
|
|
389
|
+
"scope": "Prowler 5.47.0 check etcd_peer_client_cert_auth (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
390
390
|
"evidenceType": "Configuration",
|
|
391
391
|
"severity": "high"
|
|
392
392
|
},
|
|
393
393
|
{
|
|
394
394
|
"id": "prowler.kubernetes.etcd_peer_tls_config",
|
|
395
395
|
"title": "Etcd pod uses TLS for peer connections",
|
|
396
|
-
"scope": "Prowler 5.
|
|
396
|
+
"scope": "Prowler 5.47.0 check etcd_peer_tls_config (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
397
397
|
"evidenceType": "Configuration",
|
|
398
398
|
"severity": "high"
|
|
399
399
|
},
|
|
400
400
|
{
|
|
401
401
|
"id": "prowler.kubernetes.etcd_tls_encryption",
|
|
402
402
|
"title": "Etcd pod has TLS encryption configured",
|
|
403
|
-
"scope": "Prowler 5.
|
|
403
|
+
"scope": "Prowler 5.47.0 check etcd_tls_encryption (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
404
404
|
"evidenceType": "Configuration",
|
|
405
405
|
"severity": "high"
|
|
406
406
|
},
|
|
407
407
|
{
|
|
408
408
|
"id": "prowler.kubernetes.kubelet_authorization_mode",
|
|
409
409
|
"title": "Kubelet --authorization-mode is not set to AlwaysAllow",
|
|
410
|
-
"scope": "Prowler 5.
|
|
410
|
+
"scope": "Prowler 5.47.0 check kubelet_authorization_mode (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
411
411
|
"evidenceType": "Configuration",
|
|
412
412
|
"severity": "high"
|
|
413
413
|
},
|
|
414
414
|
{
|
|
415
415
|
"id": "prowler.kubernetes.kubelet_client_ca_file_set",
|
|
416
416
|
"title": "Kubelet has a client CA file configured for authentication",
|
|
417
|
-
"scope": "Prowler 5.
|
|
417
|
+
"scope": "Prowler 5.47.0 check kubelet_client_ca_file_set (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
418
418
|
"evidenceType": "Configuration",
|
|
419
419
|
"severity": "high"
|
|
420
420
|
},
|
|
421
421
|
{
|
|
422
422
|
"id": "prowler.kubernetes.kubelet_disable_read_only_port",
|
|
423
423
|
"title": "Kubelet read-only port is disabled (set to 0)",
|
|
424
|
-
"scope": "Prowler 5.
|
|
424
|
+
"scope": "Prowler 5.47.0 check kubelet_disable_read_only_port (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
425
425
|
"evidenceType": "Configuration",
|
|
426
426
|
"severity": "medium"
|
|
427
427
|
},
|
|
428
428
|
{
|
|
429
429
|
"id": "prowler.kubernetes.kubelet_rotate_certificates",
|
|
430
430
|
"title": "Kubelet client certificate rotation is enabled",
|
|
431
|
-
"scope": "Prowler 5.
|
|
431
|
+
"scope": "Prowler 5.47.0 check kubelet_rotate_certificates (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
432
432
|
"evidenceType": "Configuration",
|
|
433
433
|
"severity": "high"
|
|
434
434
|
},
|
|
435
435
|
{
|
|
436
436
|
"id": "prowler.kubernetes.kubelet_streaming_connection_timeout",
|
|
437
437
|
"title": "Kubelet streaming connection idle timeout is not set to 0",
|
|
438
|
-
"scope": "Prowler 5.
|
|
438
|
+
"scope": "Prowler 5.47.0 check kubelet_streaming_connection_timeout (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
439
439
|
"evidenceType": "Configuration",
|
|
440
440
|
"severity": "medium"
|
|
441
441
|
},
|
|
442
442
|
{
|
|
443
443
|
"id": "prowler.kubernetes.kubelet_tls_cert_and_key",
|
|
444
444
|
"title": "Kubelet has TLS certificate and private key files configured",
|
|
445
|
-
"scope": "Prowler 5.
|
|
445
|
+
"scope": "Prowler 5.47.0 check kubelet_tls_cert_and_key (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
446
446
|
"evidenceType": "Configuration",
|
|
447
447
|
"severity": "high"
|
|
448
448
|
},
|
|
449
449
|
{
|
|
450
450
|
"id": "prowler.kubernetes.rbac_cluster_admin_usage",
|
|
451
451
|
"title": "Cluster role binding does not grant the cluster-admin role",
|
|
452
|
-
"scope": "Prowler 5.
|
|
452
|
+
"scope": "Prowler 5.47.0 check rbac_cluster_admin_usage (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
453
453
|
"evidenceType": "Configuration",
|
|
454
454
|
"severity": "critical"
|
|
455
455
|
},
|
|
456
456
|
{
|
|
457
457
|
"id": "prowler.kubernetes.rbac_minimize_csr_approval_access",
|
|
458
458
|
"title": "User or group lacks update and patch access to the certificatesigningrequests/approval sub-resource",
|
|
459
|
-
"scope": "Prowler 5.
|
|
459
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_csr_approval_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
460
460
|
"evidenceType": "Configuration",
|
|
461
461
|
"severity": "high"
|
|
462
462
|
},
|
|
463
463
|
{
|
|
464
464
|
"id": "prowler.kubernetes.rbac_minimize_node_proxy_subresource_access",
|
|
465
465
|
"title": "User or group has no get, list, or watch permissions on the nodes/proxy sub-resource",
|
|
466
|
-
"scope": "Prowler 5.
|
|
466
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_node_proxy_subresource_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
467
467
|
"evidenceType": "Configuration",
|
|
468
468
|
"severity": "high"
|
|
469
469
|
},
|
|
470
470
|
{
|
|
471
471
|
"id": "prowler.kubernetes.rbac_minimize_pod_creation_access",
|
|
472
472
|
"title": "Role or ClusterRole does not grant create permission on pods",
|
|
473
|
-
"scope": "Prowler 5.
|
|
473
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_pod_creation_access (Kubernetes rbac, resource type ClusterRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
474
474
|
"evidenceType": "Configuration",
|
|
475
475
|
"severity": "high"
|
|
476
476
|
},
|
|
477
477
|
{
|
|
478
478
|
"id": "prowler.kubernetes.rbac_minimize_pv_creation_access",
|
|
479
479
|
"title": "User or group does not have permission to create PersistentVolumes",
|
|
480
|
-
"scope": "Prowler 5.
|
|
480
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_pv_creation_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
481
481
|
"evidenceType": "Configuration",
|
|
482
482
|
"severity": "high"
|
|
483
483
|
},
|
|
484
484
|
{
|
|
485
485
|
"id": "prowler.kubernetes.rbac_minimize_secret_access",
|
|
486
486
|
"title": "Role or ClusterRole does not grant get, list, or watch access to Kubernetes Secrets",
|
|
487
|
-
"scope": "Prowler 5.
|
|
487
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_secret_access (Kubernetes rbac, resource type ClusterRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
488
488
|
"evidenceType": "Configuration",
|
|
489
489
|
"severity": "high"
|
|
490
490
|
},
|
|
491
491
|
{
|
|
492
492
|
"id": "prowler.kubernetes.rbac_minimize_service_account_token_creation",
|
|
493
493
|
"title": "User or group does not have permission to create service account tokens",
|
|
494
|
-
"scope": "Prowler 5.
|
|
494
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_service_account_token_creation (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
495
495
|
"evidenceType": "Configuration",
|
|
496
496
|
"severity": "high"
|
|
497
497
|
},
|
|
498
498
|
{
|
|
499
499
|
"id": "prowler.kubernetes.rbac_minimize_webhook_config_access",
|
|
500
500
|
"title": "User or group does not have create, update, or delete permissions on webhook configurations",
|
|
501
|
-
"scope": "Prowler 5.
|
|
501
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_webhook_config_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
502
502
|
"evidenceType": "Configuration",
|
|
503
503
|
"severity": "high"
|
|
504
504
|
},
|
|
505
505
|
{
|
|
506
506
|
"id": "prowler.kubernetes.rbac_minimize_wildcard_use_roles",
|
|
507
507
|
"title": "Role or ClusterRole does not use wildcard resources or verbs",
|
|
508
|
-
"scope": "Prowler 5.
|
|
508
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_wildcard_use_roles (Kubernetes rbac, resource type ClusterRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
509
509
|
"evidenceType": "Configuration",
|
|
510
510
|
"severity": "high"
|
|
511
511
|
},
|
|
512
512
|
{
|
|
513
513
|
"id": "prowler.kubernetes.scheduler_bind_address",
|
|
514
514
|
"title": "Scheduler pod has --bind-address set to 127.0.0.1",
|
|
515
|
-
"scope": "Prowler 5.
|
|
515
|
+
"scope": "Prowler 5.47.0 check scheduler_bind_address (Kubernetes scheduler, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
516
516
|
"evidenceType": "Configuration",
|
|
517
517
|
"severity": "high"
|
|
518
518
|
},
|
|
519
519
|
{
|
|
520
520
|
"id": "prowler.kubernetes.scheduler_profiling",
|
|
521
521
|
"title": "Scheduler pod has profiling disabled",
|
|
522
|
-
"scope": "Prowler 5.
|
|
522
|
+
"scope": "Prowler 5.47.0 check scheduler_profiling (Kubernetes scheduler, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
523
523
|
"evidenceType": "Configuration",
|
|
524
524
|
"severity": "medium"
|
|
525
525
|
}
|