ComplianceAsCode / ComplianceAsCode/content
check for makeIPTablesUtilChains does not reflect benchmark and product description
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
- Rule `kubelet_enable_iptables_util_chains` of openshift ([link](https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/kubelet/kubelet_enable_iptables_util_chains/rule.yml)) checks existence of `.makeIPTablesUtilChains` and its value should be `true`
```
template:
name: yamlfile_value
vars:
filepath: {{{ kubeletconf_path }}}
yamlpath: ".makeIPTablesUtilChains"
values:
- value: "true"
operation: "equals"
```
- However, CIS Benchmark spec and [kubelet documentation](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/) say that the default value of `.makeIPTablesUtilChains` is `true`
- According to the spec and the doc, it is better to check non-existence of `.makeIPTablesUtilChains` is `false`
```
template:
name: yamlfile_value
vars:
filepath: {{{ kubeletconf_path }}}
check_existence: "none_exist"
yamlpath: ".makeIPTablesUtilChains"
values:
- value: "false"
operation: "equals"
```
#### Steps to Reproduce:
Run `cis-node` profile check on an OpenShift cluster which configuration (`/etc/kubernetes/kubelet.conf`) does not contain `.makeIPTablesUtilChains`.
#### Actual Results:
`FAIL`
#### Expected Results:
`PASS`
Contributor guide
Assessment
This issue has not been assessed yet.