[Security Hardened Shoot Cluster] Rule 2000 Implementation #362
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
gardener-robot
added
needs/review
gardener-robot-ci-2
added
the
reviewed/ok-to-test
gardener-robot-ci-1
added
needs/ok-to-test
AleksandarSavchev
requested changes
Nov 18, 2024
pkg/provider/garden/ruleset/securityhardenedshoot/rules/2000_test.go
Outdated
Show resolved
Hide resolved
pkg/provider/garden/ruleset/securityhardenedshoot/rules/2000_test.go
Outdated
Show resolved
Hide resolved
gardener-robot-ci-3
added
reviewed/ok-to-test
| } | ||
| }) | ||
|
|
||
| DescribeTable("Run cases", func(updateFn func(), expectedCheckResults []rule.CheckResult) { |
There was a problem hiding this comment.
Suggested change
| DescribeTable("Run cases", func(updateFn func(), expectedCheckResults []rule.CheckResult) { | |
| DescribeTable("Run cases", func(updateFn func(), expectedCheckResult rule.CheckResult) { |
Last comment, no need for expectedCheckResults to be a slice when the function can only return a single rule.CheckResult
gardener-robot-ci-3
added
the
reviewed/ok-to-test
gardener-robot-ci-1
removed
the
reviewed/ok-to-test
gardener-robot
added
reviewed/lgtm
gardener-robot-ci-1
added
the
reviewed/ok-to-test
georgibaltiev
changed the title
dimityrmirchev
requested changes
Nov 18, 2024
Comment on lines
49
to
52
| case *shoot.Spec.Kubernetes.KubeAPIServer.EnableAnonymousAuthentication: | ||
| return rule.Result(r, rule.FailedCheckResult("Anonymous authentication is enabled on the kube-apiserver.", rule.NewTarget())), nil | ||
| default: | ||
| return rule.Result(r, rule.PassedCheckResult("Anonymous authentication is disabled on the kube-apiserver.", rule.NewTarget())), nil |
There was a problem hiding this comment.
Suggested change
| case *shoot.Spec.Kubernetes.KubeAPIServer.EnableAnonymousAuthentication: | |
| return rule.Result(r, rule.FailedCheckResult("Anonymous authentication is enabled on the kube-apiserver.", rule.NewTarget())), nil | |
| default: | |
| return rule.Result(r, rule.PassedCheckResult("Anonymous authentication is disabled on the kube-apiserver.", rule.NewTarget())), nil | |
| case *shoot.Spec.Kubernetes.KubeAPIServer.EnableAnonymousAuthentication: | |
| return rule.Result(r, rule.FailedCheckResult("Anonymous authentication is enabled for the kube-apiserver.", rule.NewTarget())), nil | |
| default: | |
| return rule.Result(r, rule.PassedCheckResult("Anonymous authentication is disabled for the kube-apiserver.", rule.NewTarget())), nil |
gardener-robot
added
needs/changes
gardener-robot-ci-3
removed
the
reviewed/ok-to-test
gardener-robot
added
reviewed/lgtm
gardener-robot-ci-3
added
the
reviewed/ok-to-test
13 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
This PR is an implementation of the Rule 2000 of the Security Hardened Shoot Cluster Ruleset. It retrieves metadata about the shoot cluster and evaluates the EnableAnonymousAuthentication flag (if present) of the Kube API Server component.
Which issue(s) this PR fixes:
Part of #304
Special notes for your reviewer:
Release note: