@sagentix-inc/evidence-collector 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +1926 -491
- package/apps/sos-app/src/data/checks/prowler_azure.json +634 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +207 -3
- package/apps/sos-app/src/data/checks/prowler_gcp.json +274 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +193 -3
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +459 -3
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +208 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +643 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +207 -3
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +81 -26
- package/package.json +1 -1
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: Kubernetes (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"ClusterRole prowler-read-cluster: get, list, watch on pods, configmaps, nodes, namespaces, clusterrolebindings, rolebindings, clusterroles, roles (kubernetes/prowler-role.yaml)"
|
|
6
6
|
],
|
|
7
7
|
"engine": {
|
|
8
8
|
"name": "Prowler",
|
|
9
|
-
"version": "5.
|
|
9
|
+
"version": "5.47.0",
|
|
10
10
|
"licence": "Apache-2.0",
|
|
11
11
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
12
12
|
},
|
|
@@ -15,511 +15,644 @@
|
|
|
15
15
|
{
|
|
16
16
|
"id": "prowler.kubernetes.apiserver_always_pull_images_plugin",
|
|
17
17
|
"title": "API server pod has AlwaysPullImages admission control plugin enabled",
|
|
18
|
-
"scope": "Prowler 5.
|
|
18
|
+
"scope": "Prowler 5.47.0 check apiserver_always_pull_images_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
19
19
|
"evidenceType": "Configuration",
|
|
20
20
|
"severity": "medium"
|
|
21
21
|
},
|
|
22
22
|
{
|
|
23
23
|
"id": "prowler.kubernetes.apiserver_anonymous_requests",
|
|
24
24
|
"title": "API server pod has anonymous-auth disabled",
|
|
25
|
-
"scope": "Prowler 5.
|
|
25
|
+
"scope": "Prowler 5.47.0 check apiserver_anonymous_requests (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
26
26
|
"evidenceType": "Configuration",
|
|
27
27
|
"severity": "high"
|
|
28
28
|
},
|
|
29
29
|
{
|
|
30
30
|
"id": "prowler.kubernetes.apiserver_audit_log_maxage_set",
|
|
31
31
|
"title": "API server pod has --audit-log-maxage set to 30 (or the cluster-configured value)",
|
|
32
|
-
"scope": "Prowler 5.
|
|
32
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_maxage_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
33
33
|
"evidenceType": "Configuration",
|
|
34
34
|
"severity": "medium"
|
|
35
35
|
},
|
|
36
36
|
{
|
|
37
37
|
"id": "prowler.kubernetes.apiserver_audit_log_maxbackup_set",
|
|
38
38
|
"title": "API server pod has --audit-log-maxbackup set to 10 or the configured value",
|
|
39
|
-
"scope": "Prowler 5.
|
|
39
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_maxbackup_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
40
40
|
"evidenceType": "Configuration",
|
|
41
41
|
"severity": "medium"
|
|
42
42
|
},
|
|
43
43
|
{
|
|
44
44
|
"id": "prowler.kubernetes.apiserver_audit_log_maxsize_set",
|
|
45
45
|
"title": "API server pod has --audit-log-maxsize set to 100 MB or the configured value",
|
|
46
|
-
"scope": "Prowler 5.
|
|
46
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_maxsize_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
47
47
|
"evidenceType": "Configuration",
|
|
48
48
|
"severity": "medium"
|
|
49
49
|
},
|
|
50
50
|
{
|
|
51
51
|
"id": "prowler.kubernetes.apiserver_audit_log_path_set",
|
|
52
52
|
"title": "API server pod has --audit-log-path set",
|
|
53
|
-
"scope": "Prowler 5.
|
|
53
|
+
"scope": "Prowler 5.47.0 check apiserver_audit_log_path_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
54
54
|
"evidenceType": "Configuration",
|
|
55
55
|
"severity": "high"
|
|
56
56
|
},
|
|
57
57
|
{
|
|
58
58
|
"id": "prowler.kubernetes.apiserver_auth_mode_include_node",
|
|
59
59
|
"title": "API server pod has Node in --authorization-mode",
|
|
60
|
-
"scope": "Prowler 5.
|
|
60
|
+
"scope": "Prowler 5.47.0 check apiserver_auth_mode_include_node (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
61
61
|
"evidenceType": "Configuration",
|
|
62
62
|
"severity": "high"
|
|
63
63
|
},
|
|
64
64
|
{
|
|
65
65
|
"id": "prowler.kubernetes.apiserver_auth_mode_include_rbac",
|
|
66
66
|
"title": "API server pod authorization mode includes RBAC",
|
|
67
|
-
"scope": "Prowler 5.
|
|
67
|
+
"scope": "Prowler 5.47.0 check apiserver_auth_mode_include_rbac (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
68
68
|
"evidenceType": "Configuration",
|
|
69
69
|
"severity": "high"
|
|
70
70
|
},
|
|
71
71
|
{
|
|
72
72
|
"id": "prowler.kubernetes.apiserver_auth_mode_not_always_allow",
|
|
73
73
|
"title": "API server pod does not use the AlwaysAllow authorization mode",
|
|
74
|
-
"scope": "Prowler 5.
|
|
74
|
+
"scope": "Prowler 5.47.0 check apiserver_auth_mode_not_always_allow (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
75
75
|
"evidenceType": "Configuration",
|
|
76
76
|
"severity": "critical"
|
|
77
77
|
},
|
|
78
78
|
{
|
|
79
79
|
"id": "prowler.kubernetes.apiserver_client_ca_file_set",
|
|
80
80
|
"title": "API server pod has the --client-ca-file argument set",
|
|
81
|
-
"scope": "Prowler 5.
|
|
81
|
+
"scope": "Prowler 5.47.0 check apiserver_client_ca_file_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
82
82
|
"evidenceType": "Configuration",
|
|
83
83
|
"severity": "high"
|
|
84
84
|
},
|
|
85
85
|
{
|
|
86
86
|
"id": "prowler.kubernetes.apiserver_deny_service_external_ips",
|
|
87
87
|
"title": "API server pod has DenyServiceExternalIPs admission controller enabled",
|
|
88
|
-
"scope": "Prowler 5.
|
|
88
|
+
"scope": "Prowler 5.47.0 check apiserver_deny_service_external_ips (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
89
89
|
"evidenceType": "Configuration",
|
|
90
90
|
"severity": "high"
|
|
91
91
|
},
|
|
92
92
|
{
|
|
93
93
|
"id": "prowler.kubernetes.apiserver_disable_profiling",
|
|
94
94
|
"title": "API server pod has profiling disabled (--profiling=false)",
|
|
95
|
-
"scope": "Prowler 5.
|
|
95
|
+
"scope": "Prowler 5.47.0 check apiserver_disable_profiling (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
96
96
|
"evidenceType": "Configuration",
|
|
97
97
|
"severity": "medium"
|
|
98
98
|
},
|
|
99
99
|
{
|
|
100
100
|
"id": "prowler.kubernetes.apiserver_encryption_provider_config_set",
|
|
101
101
|
"title": "API server pod has the --encryption-provider-config argument set",
|
|
102
|
-
"scope": "Prowler 5.
|
|
102
|
+
"scope": "Prowler 5.47.0 check apiserver_encryption_provider_config_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
103
103
|
"evidenceType": "Configuration",
|
|
104
104
|
"severity": "high"
|
|
105
105
|
},
|
|
106
106
|
{
|
|
107
107
|
"id": "prowler.kubernetes.apiserver_etcd_cafile_set",
|
|
108
108
|
"title": "API server pod has the --etcd-cafile argument set",
|
|
109
|
-
"scope": "Prowler 5.
|
|
109
|
+
"scope": "Prowler 5.47.0 check apiserver_etcd_cafile_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
110
110
|
"evidenceType": "Configuration",
|
|
111
111
|
"severity": "critical"
|
|
112
112
|
},
|
|
113
113
|
{
|
|
114
114
|
"id": "prowler.kubernetes.apiserver_etcd_tls_config",
|
|
115
115
|
"title": "API server pod has --etcd-certfile and --etcd-keyfile configured for etcd TLS",
|
|
116
|
-
"scope": "Prowler 5.
|
|
116
|
+
"scope": "Prowler 5.47.0 check apiserver_etcd_tls_config (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
117
117
|
"evidenceType": "Configuration",
|
|
118
118
|
"severity": "critical"
|
|
119
119
|
},
|
|
120
120
|
{
|
|
121
121
|
"id": "prowler.kubernetes.apiserver_event_rate_limit",
|
|
122
122
|
"title": "API server pod has the EventRateLimit admission control plugin enabled",
|
|
123
|
-
"scope": "Prowler 5.
|
|
123
|
+
"scope": "Prowler 5.47.0 check apiserver_event_rate_limit (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
124
124
|
"evidenceType": "Configuration",
|
|
125
125
|
"severity": "medium"
|
|
126
126
|
},
|
|
127
127
|
{
|
|
128
128
|
"id": "prowler.kubernetes.apiserver_kubelet_cert_auth",
|
|
129
129
|
"title": "API server pod has --kubelet-certificate-authority configured",
|
|
130
|
-
"scope": "Prowler 5.
|
|
130
|
+
"scope": "Prowler 5.47.0 check apiserver_kubelet_cert_auth (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
131
131
|
"evidenceType": "Configuration",
|
|
132
132
|
"severity": "critical"
|
|
133
133
|
},
|
|
134
134
|
{
|
|
135
135
|
"id": "prowler.kubernetes.apiserver_kubelet_tls_auth",
|
|
136
136
|
"title": "API server pod has --kubelet-client-certificate and --kubelet-client-key arguments configured",
|
|
137
|
-
"scope": "Prowler 5.
|
|
137
|
+
"scope": "Prowler 5.47.0 check apiserver_kubelet_tls_auth (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
138
138
|
"evidenceType": "Configuration",
|
|
139
139
|
"severity": "critical"
|
|
140
140
|
},
|
|
141
141
|
{
|
|
142
142
|
"id": "prowler.kubernetes.apiserver_namespace_lifecycle_plugin",
|
|
143
143
|
"title": "API server pod has NamespaceLifecycle admission control plugin enabled",
|
|
144
|
-
"scope": "Prowler 5.
|
|
144
|
+
"scope": "Prowler 5.47.0 check apiserver_namespace_lifecycle_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
145
145
|
"evidenceType": "Configuration",
|
|
146
146
|
"severity": "high"
|
|
147
147
|
},
|
|
148
148
|
{
|
|
149
149
|
"id": "prowler.kubernetes.apiserver_no_always_admit_plugin",
|
|
150
150
|
"title": "API server pod does not have the AlwaysAdmit admission control plugin enabled",
|
|
151
|
-
"scope": "Prowler 5.
|
|
151
|
+
"scope": "Prowler 5.47.0 check apiserver_no_always_admit_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
152
152
|
"evidenceType": "Configuration",
|
|
153
153
|
"severity": "critical"
|
|
154
154
|
},
|
|
155
155
|
{
|
|
156
156
|
"id": "prowler.kubernetes.apiserver_no_token_auth_file",
|
|
157
157
|
"title": "API server pod does not have --token-auth-file enabled",
|
|
158
|
-
"scope": "Prowler 5.
|
|
158
|
+
"scope": "Prowler 5.47.0 check apiserver_no_token_auth_file (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
159
159
|
"evidenceType": "Configuration",
|
|
160
160
|
"severity": "high"
|
|
161
161
|
},
|
|
162
162
|
{
|
|
163
163
|
"id": "prowler.kubernetes.apiserver_node_restriction_plugin",
|
|
164
164
|
"title": "API server pod has NodeRestriction admission control plugin enabled",
|
|
165
|
-
"scope": "Prowler 5.
|
|
165
|
+
"scope": "Prowler 5.47.0 check apiserver_node_restriction_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
166
166
|
"evidenceType": "Configuration",
|
|
167
167
|
"severity": "high"
|
|
168
168
|
},
|
|
169
169
|
{
|
|
170
170
|
"id": "prowler.kubernetes.apiserver_request_timeout_set",
|
|
171
171
|
"title": "API server pod has --request-timeout configured",
|
|
172
|
-
"scope": "Prowler 5.
|
|
172
|
+
"scope": "Prowler 5.47.0 check apiserver_request_timeout_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
173
173
|
"evidenceType": "Configuration",
|
|
174
174
|
"severity": "medium"
|
|
175
175
|
},
|
|
176
176
|
{
|
|
177
177
|
"id": "prowler.kubernetes.apiserver_security_context_deny_plugin",
|
|
178
178
|
"title": "API server pod uses PodSecurityPolicy or has the SecurityContextDeny admission plugin enabled",
|
|
179
|
-
"scope": "Prowler 5.
|
|
179
|
+
"scope": "Prowler 5.47.0 check apiserver_security_context_deny_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
180
180
|
"evidenceType": "Configuration",
|
|
181
181
|
"severity": "high"
|
|
182
182
|
},
|
|
183
183
|
{
|
|
184
184
|
"id": "prowler.kubernetes.apiserver_service_account_key_file_set",
|
|
185
185
|
"title": "API server pod has --service-account-key-file configured",
|
|
186
|
-
"scope": "Prowler 5.
|
|
186
|
+
"scope": "Prowler 5.47.0 check apiserver_service_account_key_file_set (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
187
187
|
"evidenceType": "Configuration",
|
|
188
188
|
"severity": "high"
|
|
189
189
|
},
|
|
190
190
|
{
|
|
191
191
|
"id": "prowler.kubernetes.apiserver_service_account_lookup_true",
|
|
192
192
|
"title": "API server pod has --service-account-lookup set to true",
|
|
193
|
-
"scope": "Prowler 5.
|
|
193
|
+
"scope": "Prowler 5.47.0 check apiserver_service_account_lookup_true (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
194
194
|
"evidenceType": "Configuration",
|
|
195
195
|
"severity": "high"
|
|
196
196
|
},
|
|
197
197
|
{
|
|
198
198
|
"id": "prowler.kubernetes.apiserver_service_account_plugin",
|
|
199
199
|
"title": "API server pod has ServiceAccount admission control plugin enabled",
|
|
200
|
-
"scope": "Prowler 5.
|
|
200
|
+
"scope": "Prowler 5.47.0 check apiserver_service_account_plugin (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
201
201
|
"evidenceType": "Configuration",
|
|
202
202
|
"severity": "high"
|
|
203
203
|
},
|
|
204
|
+
{
|
|
205
|
+
"id": "prowler.kubernetes.apiserver_strong_ciphers_only",
|
|
206
|
+
"title": "API Server pod uses only strong cryptographic TLS cipher suites",
|
|
207
|
+
"scope": "Prowler 5.47.0 check apiserver_strong_ciphers_only (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
208
|
+
"evidenceType": "Configuration",
|
|
209
|
+
"severity": "medium"
|
|
210
|
+
},
|
|
204
211
|
{
|
|
205
212
|
"id": "prowler.kubernetes.apiserver_tls_config",
|
|
206
213
|
"title": "API server pod has --tls-cert-file and --tls-private-key-file configured",
|
|
207
|
-
"scope": "Prowler 5.
|
|
214
|
+
"scope": "Prowler 5.47.0 check apiserver_tls_config (Kubernetes apiserver, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
208
215
|
"evidenceType": "Configuration",
|
|
209
216
|
"severity": "high"
|
|
210
217
|
},
|
|
211
218
|
{
|
|
212
219
|
"id": "prowler.kubernetes.controllermanager_bind_address",
|
|
213
220
|
"title": "Controller Manager pod is bound to the loopback address 127.0.0.1",
|
|
214
|
-
"scope": "Prowler 5.
|
|
221
|
+
"scope": "Prowler 5.47.0 check controllermanager_bind_address (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
215
222
|
"evidenceType": "Configuration",
|
|
216
223
|
"severity": "high"
|
|
217
224
|
},
|
|
218
225
|
{
|
|
219
226
|
"id": "prowler.kubernetes.controllermanager_disable_profiling",
|
|
220
227
|
"title": "Controller Manager pod has --profiling=false configured",
|
|
221
|
-
"scope": "Prowler 5.
|
|
228
|
+
"scope": "Prowler 5.47.0 check controllermanager_disable_profiling (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
222
229
|
"evidenceType": "Configuration",
|
|
223
230
|
"severity": "medium"
|
|
224
231
|
},
|
|
232
|
+
{
|
|
233
|
+
"id": "prowler.kubernetes.controllermanager_garbage_collection",
|
|
234
|
+
"title": "Controller Manager pod does not use the default --terminated-pod-gc-threshold value",
|
|
235
|
+
"scope": "Prowler 5.47.0 check controllermanager_garbage_collection (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
236
|
+
"evidenceType": "Configuration",
|
|
237
|
+
"severity": "high"
|
|
238
|
+
},
|
|
225
239
|
{
|
|
226
240
|
"id": "prowler.kubernetes.controllermanager_root_ca_file_set",
|
|
227
241
|
"title": "Controller Manager pod has --root-ca-file argument set",
|
|
228
|
-
"scope": "Prowler 5.
|
|
242
|
+
"scope": "Prowler 5.47.0 check controllermanager_root_ca_file_set (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
229
243
|
"evidenceType": "Configuration",
|
|
230
244
|
"severity": "critical"
|
|
231
245
|
},
|
|
232
246
|
{
|
|
233
247
|
"id": "prowler.kubernetes.controllermanager_rotate_kubelet_server_cert",
|
|
234
248
|
"title": "Controller Manager pod has RotateKubeletServerCertificate set to true",
|
|
235
|
-
"scope": "Prowler 5.
|
|
249
|
+
"scope": "Prowler 5.47.0 check controllermanager_rotate_kubelet_server_cert (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
236
250
|
"evidenceType": "Configuration",
|
|
237
251
|
"severity": "medium"
|
|
238
252
|
},
|
|
239
253
|
{
|
|
240
254
|
"id": "prowler.kubernetes.controllermanager_service_account_credentials",
|
|
241
255
|
"title": "Controller Manager pod has --use-service-account-credentials=true",
|
|
242
|
-
"scope": "Prowler 5.
|
|
256
|
+
"scope": "Prowler 5.47.0 check controllermanager_service_account_credentials (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
243
257
|
"evidenceType": "Configuration",
|
|
244
258
|
"severity": "high"
|
|
245
259
|
},
|
|
246
260
|
{
|
|
247
261
|
"id": "prowler.kubernetes.controllermanager_service_account_private_key_file",
|
|
248
262
|
"title": "Controller Manager pod has the --service-account-private-key-file argument set",
|
|
249
|
-
"scope": "Prowler 5.
|
|
263
|
+
"scope": "Prowler 5.47.0 check controllermanager_service_account_private_key_file (Kubernetes controllermanager, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
250
264
|
"evidenceType": "Configuration",
|
|
251
265
|
"severity": "high"
|
|
252
266
|
},
|
|
253
267
|
{
|
|
254
268
|
"id": "prowler.kubernetes.core_cpu_limits_set",
|
|
255
269
|
"title": "Pod containers have CPU limits set",
|
|
256
|
-
"scope": "Prowler 5.
|
|
270
|
+
"scope": "Prowler 5.47.0 check core_cpu_limits_set (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
271
|
+
"evidenceType": "Configuration",
|
|
272
|
+
"severity": "medium"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "prowler.kubernetes.core_cpu_requests_set",
|
|
276
|
+
"title": "Pod containers have CPU requests set",
|
|
277
|
+
"scope": "Prowler 5.47.0 check core_cpu_requests_set (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
257
278
|
"evidenceType": "Configuration",
|
|
258
279
|
"severity": "medium"
|
|
259
280
|
},
|
|
260
281
|
{
|
|
261
282
|
"id": "prowler.kubernetes.core_image_tag_fixed",
|
|
262
283
|
"title": "Container images use fixed tags",
|
|
263
|
-
"scope": "Prowler 5.
|
|
284
|
+
"scope": "Prowler 5.47.0 check core_image_tag_fixed (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
264
285
|
"evidenceType": "Configuration",
|
|
265
286
|
"severity": "medium"
|
|
266
287
|
},
|
|
267
288
|
{
|
|
268
289
|
"id": "prowler.kubernetes.core_liveness_probe_configured",
|
|
269
290
|
"title": "Pod containers have liveness probes configured",
|
|
270
|
-
"scope": "Prowler 5.
|
|
291
|
+
"scope": "Prowler 5.47.0 check core_liveness_probe_configured (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
271
292
|
"evidenceType": "Configuration",
|
|
272
293
|
"severity": "medium"
|
|
273
294
|
},
|
|
274
295
|
{
|
|
275
296
|
"id": "prowler.kubernetes.core_memory_limits_set",
|
|
276
297
|
"title": "Container memory limits are configured",
|
|
277
|
-
"scope": "Prowler 5.
|
|
298
|
+
"scope": "Prowler 5.47.0 check core_memory_limits_set (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
299
|
+
"evidenceType": "Configuration",
|
|
300
|
+
"severity": "medium"
|
|
301
|
+
},
|
|
302
|
+
{
|
|
303
|
+
"id": "prowler.kubernetes.core_memory_requests_set",
|
|
304
|
+
"title": "Container memory requests are configured",
|
|
305
|
+
"scope": "Prowler 5.47.0 check core_memory_requests_set (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
278
306
|
"evidenceType": "Configuration",
|
|
279
307
|
"severity": "medium"
|
|
280
308
|
},
|
|
281
309
|
{
|
|
282
310
|
"id": "prowler.kubernetes.core_minimize_admission_hostport_containers",
|
|
283
311
|
"title": "Pod does not use HostPorts",
|
|
284
|
-
"scope": "Prowler 5.
|
|
312
|
+
"scope": "Prowler 5.47.0 check core_minimize_admission_hostport_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
285
313
|
"evidenceType": "Configuration",
|
|
286
314
|
"severity": "high"
|
|
287
315
|
},
|
|
288
316
|
{
|
|
289
317
|
"id": "prowler.kubernetes.core_minimize_admission_windows_hostprocess_containers",
|
|
290
318
|
"title": "Pod does not allow Windows HostProcess containers",
|
|
291
|
-
"scope": "Prowler 5.
|
|
319
|
+
"scope": "Prowler 5.47.0 check core_minimize_admission_windows_hostprocess_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
292
320
|
"evidenceType": "Configuration",
|
|
293
321
|
"severity": "high"
|
|
294
322
|
},
|
|
295
323
|
{
|
|
296
324
|
"id": "prowler.kubernetes.core_minimize_allowPrivilegeEscalation_containers",
|
|
297
325
|
"title": "Pod does not allow privilege escalation in any container",
|
|
298
|
-
"scope": "Prowler 5.
|
|
326
|
+
"scope": "Prowler 5.47.0 check core_minimize_allowPrivilegeEscalation_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
299
327
|
"evidenceType": "Configuration",
|
|
300
328
|
"severity": "high"
|
|
301
329
|
},
|
|
302
330
|
{
|
|
303
331
|
"id": "prowler.kubernetes.core_minimize_containers_added_capabilities",
|
|
304
332
|
"title": "Pod has no containers with added capabilities",
|
|
305
|
-
"scope": "Prowler 5.
|
|
333
|
+
"scope": "Prowler 5.47.0 check core_minimize_containers_added_capabilities (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
306
334
|
"evidenceType": "Configuration",
|
|
307
335
|
"severity": "high"
|
|
308
336
|
},
|
|
309
337
|
{
|
|
310
338
|
"id": "prowler.kubernetes.core_minimize_containers_capabilities_assigned",
|
|
311
339
|
"title": "Pod containers have no added Linux capabilities and include capability drops when capabilities are defined",
|
|
312
|
-
"scope": "Prowler 5.
|
|
340
|
+
"scope": "Prowler 5.47.0 check core_minimize_containers_capabilities_assigned (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
341
|
+
"evidenceType": "Configuration",
|
|
342
|
+
"severity": "high"
|
|
343
|
+
},
|
|
344
|
+
{
|
|
345
|
+
"id": "prowler.kubernetes.core_minimize_hostIPC_containers",
|
|
346
|
+
"title": "Pod does not use the host IPC namespace",
|
|
347
|
+
"scope": "Prowler 5.47.0 check core_minimize_hostIPC_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
313
348
|
"evidenceType": "Configuration",
|
|
314
349
|
"severity": "high"
|
|
315
350
|
},
|
|
316
351
|
{
|
|
317
352
|
"id": "prowler.kubernetes.core_minimize_hostNetwork_containers",
|
|
318
353
|
"title": "Pod does not use hostNetwork",
|
|
319
|
-
"scope": "Prowler 5.
|
|
354
|
+
"scope": "Prowler 5.47.0 check core_minimize_hostNetwork_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
355
|
+
"evidenceType": "Configuration",
|
|
356
|
+
"severity": "high"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": "prowler.kubernetes.core_minimize_hostPID_containers",
|
|
360
|
+
"title": "Pod does not use the host PID namespace",
|
|
361
|
+
"scope": "Prowler 5.47.0 check core_minimize_hostPID_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
320
362
|
"evidenceType": "Configuration",
|
|
321
363
|
"severity": "high"
|
|
322
364
|
},
|
|
323
365
|
{
|
|
324
366
|
"id": "prowler.kubernetes.core_minimize_hostpath_volume_mounts",
|
|
325
367
|
"title": "Pod does not use hostPath volumes",
|
|
326
|
-
"scope": "Prowler 5.
|
|
368
|
+
"scope": "Prowler 5.47.0 check core_minimize_hostpath_volume_mounts (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
327
369
|
"evidenceType": "Configuration",
|
|
328
370
|
"severity": "high"
|
|
329
371
|
},
|
|
330
372
|
{
|
|
331
373
|
"id": "prowler.kubernetes.core_minimize_net_raw_capability_admission",
|
|
332
374
|
"title": "Pod containers do not have the NET_RAW capability",
|
|
333
|
-
"scope": "Prowler 5.
|
|
375
|
+
"scope": "Prowler 5.47.0 check core_minimize_net_raw_capability_admission (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
334
376
|
"evidenceType": "Configuration",
|
|
335
377
|
"severity": "high"
|
|
336
378
|
},
|
|
337
379
|
{
|
|
338
380
|
"id": "prowler.kubernetes.core_minimize_privileged_containers",
|
|
339
381
|
"title": "Pod does not contain a privileged container",
|
|
340
|
-
"scope": "Prowler 5.
|
|
382
|
+
"scope": "Prowler 5.47.0 check core_minimize_privileged_containers (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
341
383
|
"evidenceType": "Configuration",
|
|
342
384
|
"severity": "high"
|
|
343
385
|
},
|
|
344
386
|
{
|
|
345
387
|
"id": "prowler.kubernetes.core_minimize_root_containers_admission",
|
|
346
388
|
"title": "Pod does not run any container as the root user",
|
|
347
|
-
"scope": "Prowler 5.
|
|
389
|
+
"scope": "Prowler 5.47.0 check core_minimize_root_containers_admission (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
390
|
+
"evidenceType": "Configuration",
|
|
391
|
+
"severity": "high"
|
|
392
|
+
},
|
|
393
|
+
{
|
|
394
|
+
"id": "prowler.kubernetes.core_no_secrets_envs",
|
|
395
|
+
"title": "Pod does not contain secret environment variables",
|
|
396
|
+
"scope": "Prowler 5.47.0 check core_no_secrets_envs (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
348
397
|
"evidenceType": "Configuration",
|
|
349
398
|
"severity": "high"
|
|
350
399
|
},
|
|
351
400
|
{
|
|
352
401
|
"id": "prowler.kubernetes.core_readiness_probe_configured",
|
|
353
402
|
"title": "Regular pod containers have readiness probes configured",
|
|
354
|
-
"scope": "Prowler 5.
|
|
403
|
+
"scope": "Prowler 5.47.0 check core_readiness_probe_configured (Kubernetes core, resource type KubernetesPod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
355
404
|
"evidenceType": "Configuration",
|
|
356
405
|
"severity": "medium"
|
|
357
406
|
},
|
|
358
407
|
{
|
|
359
408
|
"id": "prowler.kubernetes.core_readonly_root_filesystem_enabled",
|
|
360
409
|
"title": "Containers should run with a read-only root filesystem",
|
|
361
|
-
"scope": "Prowler 5.
|
|
410
|
+
"scope": "Prowler 5.47.0 check core_readonly_root_filesystem_enabled (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
362
411
|
"evidenceType": "Configuration",
|
|
363
412
|
"severity": "medium"
|
|
364
413
|
},
|
|
414
|
+
{
|
|
415
|
+
"id": "prowler.kubernetes.core_seccomp_profile_docker_default",
|
|
416
|
+
"title": "Pod has the docker/default (RuntimeDefault) seccomp profile at pod level or for all containers",
|
|
417
|
+
"scope": "Prowler 5.47.0 check core_seccomp_profile_docker_default (Kubernetes core, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
418
|
+
"evidenceType": "Configuration",
|
|
419
|
+
"severity": "high"
|
|
420
|
+
},
|
|
365
421
|
{
|
|
366
422
|
"id": "prowler.kubernetes.etcd_client_cert_auth",
|
|
367
423
|
"title": "Etcd pod has client certificate authentication enabled (--client-cert-auth=true)",
|
|
368
|
-
"scope": "Prowler 5.
|
|
424
|
+
"scope": "Prowler 5.47.0 check etcd_client_cert_auth (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
369
425
|
"evidenceType": "Configuration",
|
|
370
426
|
"severity": "high"
|
|
371
427
|
},
|
|
372
428
|
{
|
|
373
429
|
"id": "prowler.kubernetes.etcd_no_auto_tls",
|
|
374
430
|
"title": "Etcd pod has --auto-tls disabled",
|
|
375
|
-
"scope": "Prowler 5.
|
|
431
|
+
"scope": "Prowler 5.47.0 check etcd_no_auto_tls (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
376
432
|
"evidenceType": "Configuration",
|
|
377
433
|
"severity": "high"
|
|
378
434
|
},
|
|
379
435
|
{
|
|
380
436
|
"id": "prowler.kubernetes.etcd_no_peer_auto_tls",
|
|
381
437
|
"title": "Etcd pod does not use automatically generated self-signed certificates for peer TLS connections",
|
|
382
|
-
"scope": "Prowler 5.
|
|
438
|
+
"scope": "Prowler 5.47.0 check etcd_no_peer_auto_tls (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
383
439
|
"evidenceType": "Configuration",
|
|
384
440
|
"severity": "high"
|
|
385
441
|
},
|
|
386
442
|
{
|
|
387
443
|
"id": "prowler.kubernetes.etcd_peer_client_cert_auth",
|
|
388
444
|
"title": "Etcd pod has peer client certificate authentication enabled",
|
|
389
|
-
"scope": "Prowler 5.
|
|
445
|
+
"scope": "Prowler 5.47.0 check etcd_peer_client_cert_auth (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
390
446
|
"evidenceType": "Configuration",
|
|
391
447
|
"severity": "high"
|
|
392
448
|
},
|
|
393
449
|
{
|
|
394
450
|
"id": "prowler.kubernetes.etcd_peer_tls_config",
|
|
395
451
|
"title": "Etcd pod uses TLS for peer connections",
|
|
396
|
-
"scope": "Prowler 5.
|
|
452
|
+
"scope": "Prowler 5.47.0 check etcd_peer_tls_config (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
397
453
|
"evidenceType": "Configuration",
|
|
398
454
|
"severity": "high"
|
|
399
455
|
},
|
|
400
456
|
{
|
|
401
457
|
"id": "prowler.kubernetes.etcd_tls_encryption",
|
|
402
458
|
"title": "Etcd pod has TLS encryption configured",
|
|
403
|
-
"scope": "Prowler 5.
|
|
459
|
+
"scope": "Prowler 5.47.0 check etcd_tls_encryption (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
460
|
+
"evidenceType": "Configuration",
|
|
461
|
+
"severity": "high"
|
|
462
|
+
},
|
|
463
|
+
{
|
|
464
|
+
"id": "prowler.kubernetes.etcd_unique_ca",
|
|
465
|
+
"title": "Etcd pod uses a unique Certificate Authority distinct from the Kubernetes API server CA",
|
|
466
|
+
"scope": "Prowler 5.47.0 check etcd_unique_ca (Kubernetes etcd, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
404
467
|
"evidenceType": "Configuration",
|
|
405
468
|
"severity": "high"
|
|
406
469
|
},
|
|
407
470
|
{
|
|
408
471
|
"id": "prowler.kubernetes.kubelet_authorization_mode",
|
|
409
472
|
"title": "Kubelet --authorization-mode is not set to AlwaysAllow",
|
|
410
|
-
"scope": "Prowler 5.
|
|
473
|
+
"scope": "Prowler 5.47.0 check kubelet_authorization_mode (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
411
474
|
"evidenceType": "Configuration",
|
|
412
475
|
"severity": "high"
|
|
413
476
|
},
|
|
414
477
|
{
|
|
415
478
|
"id": "prowler.kubernetes.kubelet_client_ca_file_set",
|
|
416
479
|
"title": "Kubelet has a client CA file configured for authentication",
|
|
417
|
-
"scope": "Prowler 5.
|
|
480
|
+
"scope": "Prowler 5.47.0 check kubelet_client_ca_file_set (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
481
|
+
"evidenceType": "Configuration",
|
|
482
|
+
"severity": "high"
|
|
483
|
+
},
|
|
484
|
+
{
|
|
485
|
+
"id": "prowler.kubernetes.kubelet_conf_file_ownership",
|
|
486
|
+
"title": "Node kubelet.conf file ownership is set to root:root",
|
|
487
|
+
"scope": "Prowler 5.47.0 check kubelet_conf_file_ownership (Kubernetes kubelet, resource type Node): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
488
|
+
"evidenceType": "Configuration",
|
|
489
|
+
"severity": "high"
|
|
490
|
+
},
|
|
491
|
+
{
|
|
492
|
+
"id": "prowler.kubernetes.kubelet_conf_file_permissions",
|
|
493
|
+
"title": "Node kubelet.conf file permissions are set to 600 or more restrictive",
|
|
494
|
+
"scope": "Prowler 5.47.0 check kubelet_conf_file_permissions (Kubernetes kubelet, resource type Node): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
495
|
+
"evidenceType": "Configuration",
|
|
496
|
+
"severity": "high"
|
|
497
|
+
},
|
|
498
|
+
{
|
|
499
|
+
"id": "prowler.kubernetes.kubelet_config_yaml_ownership",
|
|
500
|
+
"title": "Node kubelet config.yaml file ownership is root:root",
|
|
501
|
+
"scope": "Prowler 5.47.0 check kubelet_config_yaml_ownership (Kubernetes kubelet, resource type Node): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
502
|
+
"evidenceType": "Configuration",
|
|
503
|
+
"severity": "high"
|
|
504
|
+
},
|
|
505
|
+
{
|
|
506
|
+
"id": "prowler.kubernetes.kubelet_config_yaml_permissions",
|
|
507
|
+
"title": "Kubelet config.yaml file permissions on the node are set to 600 or more restrictive",
|
|
508
|
+
"scope": "Prowler 5.47.0 check kubelet_config_yaml_permissions (Kubernetes kubelet, resource type Node): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
509
|
+
"evidenceType": "Configuration",
|
|
510
|
+
"severity": "high"
|
|
511
|
+
},
|
|
512
|
+
{
|
|
513
|
+
"id": "prowler.kubernetes.kubelet_disable_anonymous_auth",
|
|
514
|
+
"title": "Kubelet anonymous authentication is disabled",
|
|
515
|
+
"scope": "Prowler 5.47.0 check kubelet_disable_anonymous_auth (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
418
516
|
"evidenceType": "Configuration",
|
|
419
517
|
"severity": "high"
|
|
420
518
|
},
|
|
421
519
|
{
|
|
422
520
|
"id": "prowler.kubernetes.kubelet_disable_read_only_port",
|
|
423
521
|
"title": "Kubelet read-only port is disabled (set to 0)",
|
|
424
|
-
"scope": "Prowler 5.
|
|
522
|
+
"scope": "Prowler 5.47.0 check kubelet_disable_read_only_port (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
523
|
+
"evidenceType": "Configuration",
|
|
524
|
+
"severity": "medium"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "prowler.kubernetes.kubelet_event_record_qps",
|
|
528
|
+
"title": "Kubelet eventRecordQPS is set to a positive value",
|
|
529
|
+
"scope": "Prowler 5.47.0 check kubelet_event_record_qps (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
530
|
+
"evidenceType": "Configuration",
|
|
531
|
+
"severity": "high"
|
|
532
|
+
},
|
|
533
|
+
{
|
|
534
|
+
"id": "prowler.kubernetes.kubelet_manage_iptables",
|
|
535
|
+
"title": "Kubelet configuration has makeIPTablesUtilChains set to true",
|
|
536
|
+
"scope": "Prowler 5.47.0 check kubelet_manage_iptables (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
425
537
|
"evidenceType": "Configuration",
|
|
426
538
|
"severity": "medium"
|
|
427
539
|
},
|
|
428
540
|
{
|
|
429
541
|
"id": "prowler.kubernetes.kubelet_rotate_certificates",
|
|
430
542
|
"title": "Kubelet client certificate rotation is enabled",
|
|
431
|
-
"scope": "Prowler 5.
|
|
543
|
+
"scope": "Prowler 5.47.0 check kubelet_rotate_certificates (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
544
|
+
"evidenceType": "Configuration",
|
|
545
|
+
"severity": "high"
|
|
546
|
+
},
|
|
547
|
+
{
|
|
548
|
+
"id": "prowler.kubernetes.kubelet_service_file_ownership_root",
|
|
549
|
+
"title": "Kubelet service file on the node is owned by root:root",
|
|
550
|
+
"scope": "Prowler 5.47.0 check kubelet_service_file_ownership_root (Kubernetes kubelet, resource type Node): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
551
|
+
"evidenceType": "Configuration",
|
|
552
|
+
"severity": "high"
|
|
553
|
+
},
|
|
554
|
+
{
|
|
555
|
+
"id": "prowler.kubernetes.kubelet_service_file_permissions",
|
|
556
|
+
"title": "Node kubelet service file permissions are set to 600 or more restrictive",
|
|
557
|
+
"scope": "Prowler 5.47.0 check kubelet_service_file_permissions (Kubernetes kubelet, resource type Node): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
432
558
|
"evidenceType": "Configuration",
|
|
433
559
|
"severity": "high"
|
|
434
560
|
},
|
|
435
561
|
{
|
|
436
562
|
"id": "prowler.kubernetes.kubelet_streaming_connection_timeout",
|
|
437
563
|
"title": "Kubelet streaming connection idle timeout is not set to 0",
|
|
438
|
-
"scope": "Prowler 5.
|
|
564
|
+
"scope": "Prowler 5.47.0 check kubelet_streaming_connection_timeout (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
565
|
+
"evidenceType": "Configuration",
|
|
566
|
+
"severity": "medium"
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"id": "prowler.kubernetes.kubelet_strong_ciphers_only",
|
|
570
|
+
"title": "Kubelet uses only strong TLS cipher suites",
|
|
571
|
+
"scope": "Prowler 5.47.0 check kubelet_strong_ciphers_only (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
439
572
|
"evidenceType": "Configuration",
|
|
440
573
|
"severity": "medium"
|
|
441
574
|
},
|
|
442
575
|
{
|
|
443
576
|
"id": "prowler.kubernetes.kubelet_tls_cert_and_key",
|
|
444
577
|
"title": "Kubelet has TLS certificate and private key files configured",
|
|
445
|
-
"scope": "Prowler 5.
|
|
578
|
+
"scope": "Prowler 5.47.0 check kubelet_tls_cert_and_key (Kubernetes kubelet, resource type ConfigMap): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
446
579
|
"evidenceType": "Configuration",
|
|
447
580
|
"severity": "high"
|
|
448
581
|
},
|
|
449
582
|
{
|
|
450
583
|
"id": "prowler.kubernetes.rbac_cluster_admin_usage",
|
|
451
584
|
"title": "Cluster role binding does not grant the cluster-admin role",
|
|
452
|
-
"scope": "Prowler 5.
|
|
585
|
+
"scope": "Prowler 5.47.0 check rbac_cluster_admin_usage (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
453
586
|
"evidenceType": "Configuration",
|
|
454
587
|
"severity": "critical"
|
|
455
588
|
},
|
|
456
589
|
{
|
|
457
590
|
"id": "prowler.kubernetes.rbac_minimize_csr_approval_access",
|
|
458
591
|
"title": "User or group lacks update and patch access to the certificatesigningrequests/approval sub-resource",
|
|
459
|
-
"scope": "Prowler 5.
|
|
592
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_csr_approval_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
460
593
|
"evidenceType": "Configuration",
|
|
461
594
|
"severity": "high"
|
|
462
595
|
},
|
|
463
596
|
{
|
|
464
597
|
"id": "prowler.kubernetes.rbac_minimize_node_proxy_subresource_access",
|
|
465
598
|
"title": "User or group has no get, list, or watch permissions on the nodes/proxy sub-resource",
|
|
466
|
-
"scope": "Prowler 5.
|
|
599
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_node_proxy_subresource_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
467
600
|
"evidenceType": "Configuration",
|
|
468
601
|
"severity": "high"
|
|
469
602
|
},
|
|
470
603
|
{
|
|
471
604
|
"id": "prowler.kubernetes.rbac_minimize_pod_creation_access",
|
|
472
605
|
"title": "Role or ClusterRole does not grant create permission on pods",
|
|
473
|
-
"scope": "Prowler 5.
|
|
606
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_pod_creation_access (Kubernetes rbac, resource type ClusterRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
474
607
|
"evidenceType": "Configuration",
|
|
475
608
|
"severity": "high"
|
|
476
609
|
},
|
|
477
610
|
{
|
|
478
611
|
"id": "prowler.kubernetes.rbac_minimize_pv_creation_access",
|
|
479
612
|
"title": "User or group does not have permission to create PersistentVolumes",
|
|
480
|
-
"scope": "Prowler 5.
|
|
613
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_pv_creation_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
481
614
|
"evidenceType": "Configuration",
|
|
482
615
|
"severity": "high"
|
|
483
616
|
},
|
|
484
617
|
{
|
|
485
618
|
"id": "prowler.kubernetes.rbac_minimize_secret_access",
|
|
486
619
|
"title": "Role or ClusterRole does not grant get, list, or watch access to Kubernetes Secrets",
|
|
487
|
-
"scope": "Prowler 5.
|
|
620
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_secret_access (Kubernetes rbac, resource type ClusterRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
488
621
|
"evidenceType": "Configuration",
|
|
489
622
|
"severity": "high"
|
|
490
623
|
},
|
|
491
624
|
{
|
|
492
625
|
"id": "prowler.kubernetes.rbac_minimize_service_account_token_creation",
|
|
493
626
|
"title": "User or group does not have permission to create service account tokens",
|
|
494
|
-
"scope": "Prowler 5.
|
|
627
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_service_account_token_creation (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
495
628
|
"evidenceType": "Configuration",
|
|
496
629
|
"severity": "high"
|
|
497
630
|
},
|
|
498
631
|
{
|
|
499
632
|
"id": "prowler.kubernetes.rbac_minimize_webhook_config_access",
|
|
500
633
|
"title": "User or group does not have create, update, or delete permissions on webhook configurations",
|
|
501
|
-
"scope": "Prowler 5.
|
|
634
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_webhook_config_access (Kubernetes rbac, resource type ClusterRoleBinding): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
502
635
|
"evidenceType": "Configuration",
|
|
503
636
|
"severity": "high"
|
|
504
637
|
},
|
|
505
638
|
{
|
|
506
639
|
"id": "prowler.kubernetes.rbac_minimize_wildcard_use_roles",
|
|
507
640
|
"title": "Role or ClusterRole does not use wildcard resources or verbs",
|
|
508
|
-
"scope": "Prowler 5.
|
|
641
|
+
"scope": "Prowler 5.47.0 check rbac_minimize_wildcard_use_roles (Kubernetes rbac, resource type ClusterRole): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
509
642
|
"evidenceType": "Configuration",
|
|
510
643
|
"severity": "high"
|
|
511
644
|
},
|
|
512
645
|
{
|
|
513
646
|
"id": "prowler.kubernetes.scheduler_bind_address",
|
|
514
647
|
"title": "Scheduler pod has --bind-address set to 127.0.0.1",
|
|
515
|
-
"scope": "Prowler 5.
|
|
648
|
+
"scope": "Prowler 5.47.0 check scheduler_bind_address (Kubernetes scheduler, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
516
649
|
"evidenceType": "Configuration",
|
|
517
650
|
"severity": "high"
|
|
518
651
|
},
|
|
519
652
|
{
|
|
520
653
|
"id": "prowler.kubernetes.scheduler_profiling",
|
|
521
654
|
"title": "Scheduler pod has profiling disabled",
|
|
522
|
-
"scope": "Prowler 5.
|
|
655
|
+
"scope": "Prowler 5.47.0 check scheduler_profiling (Kubernetes scheduler, resource type Pod): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
523
656
|
"evidenceType": "Configuration",
|
|
524
657
|
"severity": "medium"
|
|
525
658
|
}
|