Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MANOPD-90205] fix for vulnerability scanning failure #474

Closed
wants to merge 3 commits into from

Conversation

pranavcracker
Copy link
Collaborator

@pranavcracker pranavcracker commented Jul 19, 2023

Description

  • When we run the kube-bench on cluster running with k8s v1.27.1 installed using kubemarine 0.18.2, we got below failures-
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)

Fixes # (issue)
MANOPD-90205

Solution

  • Fix for 1.1.12 - Set to ownership for data directory(/var/lib/etcd) as etcd:etcd

Test Cases

TestCase 1

  • Find the latest version of kube-becnh utility https://github.com/aquasecurity/kube-bench/releases

  • Upload archive to the master/worker node, for example
    scp -i ~/.ssh/shift_test_key ~/kube-bench_0.6.15_linux_amd64.tar.gz ubuntu@:/home/ubuntu

  • Unpack it to the separate folder
    tar -xvf kube-bench_0.6.15_linux_amd64.tar.gz

  • Run check as (latest Kubernetes Benchmark will be used by default [https://github.com/aquasecurity/kube-bench/blob/main/docs/platforms.md#cis-kubernetes-benchmark-support])
    ./kube-bench --config-dir <pwd>/cfg --config <pwd>/cfg/config.yaml

Results:

Before After
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) [PASS] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)

Checklist

  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • Integration CI passed
  • Unit tests. If Yes list of new/changed tests with brief description
  • There is no merge conflicts

@pranavcracker pranavcracker added the improvement New feature or request label Jul 19, 2023
@pranavcracker pranavcracker marked this pull request as ready for review July 19, 2023 11:24
@andrewluckyguy andrewluckyguy self-requested a review July 24, 2023 16:45
@pranavcracker
Copy link
Collaborator Author

As with current solution, we are running the etcd containers with root user and hence we will consider this as known issue with our solution.
Closing this PR as no further action is required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants