42 lines
1.6 KiB
YAML
42 lines
1.6 KiB
YAML
|
id: k8s-tls-config-set
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Ensure TLS config appropriately set
|
||
|
|
author: princechaddha
|
||
|
|
severity: medium
|
||
|
|
description: Checks if the tls-cert-file and tls-private-key-file arguments are properly set in the API server configuration, which is essential for secure communication.
|
||
|
|
impact: |
|
||
|
|
The absence of tls-cert-file and tls-private-key-file arguments means that the API server may not use TLS for secure communications, leading to potential security risks.
|
||
|
|
remediation: |
|
||
|
|
Configure the API server to use tls-cert-file and tls-private-key-file that point to a valid certificate and key file respectively. This setting should be part of the API server startup arguments or in its configuration file.
|
||
|
|
reference:
|
||
|
|
- https://kubernetes.io/docs/admin/kube-apiserver/
|
||
|
|
tags: cloud,devops,kubernetes,security,devsecops,api-server
|
||
|
|
|
||
|
|
self-contained: true
|
||
|
|
code:
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- 'kube-apiserver'
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- "tls-cert-file"
|
||
|
|
- "tls-private-key-file"
|
||
|
|
negative: true
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- "API server configuration is missing the tls-cert-file or tls-private-key-file argument."
|
||
|
|
|
||
|
|
# digest: 4a0a00473045022100e3dc33fefeeb5d3b9a9af3d43e89b7b7c97c50aa77b344d7e976f9340e22e7450220159e8da06b7ceb82c532bd1caeeeffba7c237c568a57988f1ada334a7c09fa83:366f2a24c8eb519f6968bd8801c08ebe
|