github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/cisbenchmarks/apiserver/kubernetes_pki_key_permission.rego (about) 1 # METADATA 2 # title: "Ensure that the Kubernetes PKI key file permission is set to 600" 3 # description: "Ensure that the Kubernetes PKI key file permission is set to 600." 4 # scope: package 5 # schemas: 6 # - input: schema["kubernetes"] 7 # related_resources: 8 # - https://www.cisecurity.org/benchmark/kubernetes 9 # custom: 10 # id: KCV0067 11 # avd_id: AVD-KCV-0067 12 # severity: CRITICAL 13 # short_code: ensure-kubernetes-pki-key-file-permission-set-600. 14 # recommended_action: "Change the Kubernetes PKI key file /etc/kubernetes/pki/*.key permission to 600" 15 # input: 16 # selector: 17 # - type: kubernetes 18 package builtin.kubernetes.KCV0067 19 20 import data.lib.kubernetes 21 22 validate_pki_key_permission(sp) := {"kubePKIKeyFilePermissions": violation} { 23 sp.kind == "NodeInfo" 24 sp.type == "master" 25 violation := {permission | permission = sp.info.kubePKIKeyFilePermissions.values[_]; permission > 600} 26 count(violation) > 0 27 } 28 29 deny[res] { 30 output := validate_pki_key_permission(input) 31 msg := "Ensure that the Kubernetes PKI key file permission is set to 600" 32 res := result.new(msg, output) 33 }