CIS K8s boolean cli arguments rules perform case sensitive check
- Dominant language
- Go
- Stars
- 58
- Forks
- 55
- Avg merge
- 9h 9m
- Merged PRs (30d)
- 424
Description
**Describe the bug**
CIS K8s rules:
`1.2.18`: Verify that the `--profiling` argument is set to `false` for `kube-apiserver`.
`1.3.2`: Verify that the `--profiling` argument is set to `false` for `kube-controller-manager`.
`1.4.1`: Verify that the `--profiling` argument is set to `false` for `kube-scheduler`.
`2.2`: Verify that the `--client-cert-auth` argument is set to `true` for `etcd`.
Evaluate to fail when the boolean values are `True`/`False`.
**Preconditions**
A k8s cluster with updated the mentioned arguments in control plane to have `True`/`False` value.
Config files:
* `/etc/kubernetes/manifests/kube-apiserver.yaml`
* `/etc/kubernetes/manifests/kube-controller-manager.yaml`
* `/etc/kubernetes/manifests/kube-scheduler.yaml`
* `/etc/kubernetes/manifests/etcd.yaml`
**To Reproduce**
Write the exact actions one should perform in order to reproduce the bug.
Steps to reproduce the behavior:
1. Install kspm in this cluster
**Expected behavior**
Those rules should pass with boolean values in this format `True`/`False`.
Technically the cli boolean flag parsing happens with `strconv.ParseBool` in all cases.
* [k8s](https://github.com/kubernetes/kubernetes/blob/546f7c30860dcdecb75c544230a1b7cdf5bd5958/staging/src/k8s.io/component-base/cli/flag/sectioned.go#L38) uses the library [spf13/pflag](https://github.com/spf13/pflag/blob/d5e0c0615acee7028e1e2740a11102313be88de1/bool.go#L21).
* [etcd](https://github.com/etcd-io/etcd/blob/9f8756b90de5f6d04931feb0ac0dc91493cd8b61/server/embed/config.go#L654) uses go [flag](https://cs.opensource.google/go/go/+/master:src/flag/flag.go;l=134) package.
[`strconv.ParseBool`](https://cs.opensource.google/go/go/+/master:src/strconv/atob.go;l=10) accepts these values:
* `"1"`, `"t"`, `"T"`, `"true"`, `"TRUE"`, `"True"` as `true`
* `"0"`, `"f"`, `"F"`, `"false"`, `"FALSE"`, `"False"` as `false`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.