ComplianceAsCode / ComplianceAsCode/content

check for makeIPTablesUtilChains does not reflect benchmark and product description

Open
#8,453 3 comments 0 reactions 0 assignees View on GitHub
Kubernetes
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
- Rule `kubelet_enable_iptables_util_chains` of openshift ([link](https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/kubelet/kubelet_enable_iptables_util_chains/rule.yml)) checks existence of `.makeIPTablesUtilChains` and its value should be `true`
```
template:
name: yamlfile_value
vars:
filepath: {{{ kubeletconf_path }}}
yamlpath: ".makeIPTablesUtilChains"
values:
- value: "true"
operation: "equals"
```
- However, CIS Benchmark spec and [kubelet documentation](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/) say that the default value of `.makeIPTablesUtilChains` is `true`
- According to the spec and the doc, it is better to check non-existence of `.makeIPTablesUtilChains` is `false`
```
template:
name: yamlfile_value
vars:
filepath: {{{ kubeletconf_path }}}
check_existence: "none_exist"
yamlpath: ".makeIPTablesUtilChains"
values:
- value: "false"
operation: "equals"
```

#### Steps to Reproduce:
Run `cis-node` profile check on an OpenShift cluster which configuration (`/etc/kubernetes/kubelet.conf`) does not contain `.makeIPTablesUtilChains`.

#### Actual Results:
`FAIL`

#### Expected Results:
`PASS`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.