-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
OCP4 CIS: Re-add forgotten rules #10864
Conversation
@@ -47,6 +47,8 @@ controls: | |||
rules: | |||
- file_groupowner_kubelet_conf | |||
- file_owner_kubelet_conf | |||
#- file_groupowner_kubelet | |||
- file_owner_kubelet |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Vincent056 Are these rules still valid? We have file_owner_kubelet
that seems reasonable, but file_groupowner_kubelet
is missing despite having been used in the original CIS profile. Should we drop the rules or re-add the group one?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it looks like we were missing that one, let's keep this one here, and re-add the group one
/test e2e-aws-ocp4-cis |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
Thanks for this. Waiting to see what others have to say and what CI reports, but otherwise this looks good to me.
applications/openshift/controller/controller_rotate_kubelet_server_certs/rule.yml
Outdated
Show resolved
Hide resolved
2698a8c
to
ac6e08a
Compare
Code Climate has analyzed commit ac6e08a and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.2% (0.0% change). View more on Code Climate. |
/test e2e-aws-ocp4-cis |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks Jakub, LGTM!
Fail on |
Description:
_kube
in the name and one of them is manual, the other is automated. Let's use the automated one.Rationale:
Review Hints: