Smart Cities

https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/kube-hunter/

Incubation Level Review Results:

17 Sep 2021

Vuls:  Accepted with exceptions shown at:

Release 5 Vuls Exception Request

__________________________________________________________

Lynis:  Need to fix the following vulnerabilities:

• sysctl key fs.suid_dumpable: FAILED Expected value:  0
• sysctl key kernel.dmesg_restrict: FAILED Expected value:  1
• sysctl key net.ipv4.conf.default.accept_source_route: FAILED Expected value:  0
• The following compilers must be removed:

  as (compiler) - /usr/bin/as

  cc (compiler) - /usr/bin/cc

  g++ (compiler) - /usr/bin/g++

  gcc (compiler) - /usr/bin/gcc

_____________________________________________________

23 Aug 2021

Kube-Hunter: 

  Cluster:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

This issues must be resolved prior to maturity.

  Pod:  Could the same comparison between k3s and microk8s be provided for the kube-hunter pod.log as was provided for the cluster.log?

The following vulnerabilities must be fixed:

• Access to pod's secrets

  Suggestion: 

  https://blog.aquasec.com/managing-kubernetes-secrets

  Securing etcdsecret data is stored in etcd. By default, etcd data is not encrypted and neither are your secrets. You should enable encryption at rest, limit access to etcd to admin users only, and safely dispose of disks where etcd data was formerly stored

  Use SSL/TLSwhen running etcd in a cluster, you must use secure peer-to-peer communication.

• Exposed PodsDescription:  An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint.

• KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

• KHV007 - Specific Access to Kubernetes API Suggestion:  Review the RBAC permissions to Kubernetes API server for the anonymous and default service account

• KHV005 - Access to Kubernetes API

• KHV002 - Kubernetes version disclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

• KHV050 - Read access to Pod service account token

  Suggestion:  It is recommended to explicitly specify a Service Account for all of your workloads (serviceAccountName in Pod.Spec), and manage their permissions according to the least privilege principle.

  Consider opting out automatic mounting of SA token using automountServiceAccountToken: false on ServiceAccount resource or Pod.spec.

• KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged:  false policy.