Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove dependency on jq in example #3030

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ chmod 700 /var/lib/etcd

**Audit Script:** 1.1.11.sh

```
```bash
#!/bin/bash -e

etcd_bin=${1}
Expand Down Expand Up @@ -158,7 +158,7 @@ chown etcd:etcd /var/lib/etcd

**Audit Script:** 1.1.12.sh

```
```bash
#!/bin/bash -e

etcd_bin=${1}
Expand Down Expand Up @@ -352,7 +352,7 @@ chmod -R 600 /etc/kubernetes/ssl/certs/serverca

**Audit Script:** 1.1.21.sh

```
```bash
#!/bin/bash -e
check_dir=${1:-/etc/kubernetes/ssl}

Expand Down Expand Up @@ -1089,7 +1089,7 @@ In this file, choose **aescbc**, **kms** or **secretbox** as the encryption prov

**Audit Script:** 1.2.34.sh

```
```bash
#!/bin/bash -e

check_file=${1}
Expand Down Expand Up @@ -1493,7 +1493,7 @@ Create an audit policy file for your cluster.

**Audit Script:** 3.2.1.sh

```
```bash
#!/bin/bash -e

api_server_bin=${1}
Expand Down Expand Up @@ -2058,7 +2058,7 @@ automountServiceAccountToken: false

**Audit Script:** 5.1.5.sh

```
```bash
#!/bin/bash

export KUBECONFIG=${KUBECONFIG:-/root/.kube/config}
Expand Down Expand Up @@ -2192,7 +2192,7 @@ Follow the documentation and create `NetworkPolicy` objects as you need them.

**Audit Script:** 5.3.2.sh

```
```bash
#!/bin/bash -e

export KUBECONFIG=${KUBECONFIG:-"/root/.kube/config"}
Expand All @@ -2203,7 +2203,7 @@ if [ $? -ne 0 ]; then
exit 1
fi

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length')
if [ ${policy_count} -eq 0 ]; then
echo "fail: ${namespace}"
Expand Down Expand Up @@ -2238,7 +2238,7 @@ resources and that all new resources are created in a specific namespace.

**Audit Script:** 5.6.4.sh

```
```bash
#!/bin/bash -e

export KUBECONFIG=${KUBECONFIG:-/root/.kube/config}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,10 @@ automountServiceAccountToken: false

Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions.

```
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
done
```
Expand Down Expand Up @@ -137,10 +137,10 @@ spec:
Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to
`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions.

```
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl apply -f default-allow-all.yaml -n ${namespace}
done
```
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2192,7 +2192,7 @@ Follow the documentation and create `NetworkPolicy` objects as you need them.

**Audit Script:** 5.3.2.sh

```
```bash
#!/bin/bash -e

export KUBECONFIG=${KUBECONFIG:-"/root/.kube/config"}
Expand All @@ -2203,7 +2203,7 @@ if [ $? -ne 0 ]; then
exit 1
fi

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length')
if [ ${policy_count} -eq 0 ]; then
echo "fail: ${namespace}"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -86,10 +86,10 @@ automountServiceAccountToken: false

Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions.

```
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
done
```
Expand Down Expand Up @@ -139,10 +139,10 @@ spec:
Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to
`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions.

```
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl apply -f default-allow-all.yaml -n ${namespace}
done
```
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ chmod 700 /var/lib/etcd

**Audit Script:** 1.1.11.sh

```
```bash
#!/bin/bash -e

etcd_bin=${1}
Expand Down Expand Up @@ -156,7 +156,7 @@ chown etcd:etcd /var/lib/etcd

**Audit Script:** 1.1.12.sh

```
```bash
#!/bin/bash -e

etcd_bin=${1}
Expand Down Expand Up @@ -350,7 +350,7 @@ chmod -R 600 /etc/kubernetes/ssl/certs/serverca

**Audit Script:** 1.1.21.sh

```
```bash
#!/bin/bash -e
check_dir=${1:-/etc/kubernetes/ssl}

Expand Down Expand Up @@ -1087,7 +1087,7 @@ In this file, choose **aescbc**, **kms** or **secretbox** as the encryption prov

**Audit Script:** 1.2.34.sh

```
```bash
#!/bin/bash -e

check_file=${1}
Expand Down Expand Up @@ -1491,7 +1491,7 @@ Create an audit policy file for your cluster.

**Audit Script:** 3.2.1.sh

```
```bash
#!/bin/bash -e

api_server_bin=${1}
Expand Down Expand Up @@ -2056,7 +2056,7 @@ automountServiceAccountToken: false

**Audit Script:** 5.1.5.sh

```
```bash
#!/bin/bash

export KUBECONFIG=${KUBECONFIG:-/root/.kube/config}
Expand Down Expand Up @@ -2190,7 +2190,7 @@ Follow the documentation and create `NetworkPolicy` objects as you need them.

**Audit Script:** 5.3.2.sh

```
```bash
#!/bin/bash -e

export KUBECONFIG=${KUBECONFIG:-"/root/.kube/config"}
Expand All @@ -2201,7 +2201,7 @@ if [ $? -ne 0 ]; then
exit 1
fi

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length')
if [ ${policy_count} -eq 0 ]; then
echo "fail: ${namespace}"
Expand Down Expand Up @@ -2236,7 +2236,7 @@ resources and that all new resources are created in a specific namespace.

**Audit Script:** 5.6.4.sh

```
```bash
#!/bin/bash -e

export KUBECONFIG=${KUBECONFIG:-/root/.kube/config}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -83,10 +83,10 @@ automountServiceAccountToken: false

Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions.

```
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
done
```
Expand Down Expand Up @@ -136,10 +136,10 @@ spec:
Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to
`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions.

```
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl apply -f default-allow-all.yaml -n ${namespace}
done
```
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3132,7 +3132,7 @@ handle_error() {

trap 'handle_error' ERR

for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length')
if [[ ${policy_count} -eq 0 ]]; then
echo "false"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ Create a bash script file called `account_update.sh`. Be sure to `chmod +x accou
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
done
```
Expand Down Expand Up @@ -139,7 +139,7 @@ Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to
```bash
#!/bin/bash -e

for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
for namespace in $(kubectl get namespaces --no-headers --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'); do
kubectl apply -f default-allow-all.yaml -n ${namespace}
done
```
Expand Down