update(query): Updated "Kubelet Server Periodic Certificate Switch Disabled" to "Rotate Kubelet Server Certificate Not Active"

assets/queries/k8s/kubelet_client_periodic_certificate_switch_disabled/query.rego

@@ -5,6 +5,7 @@ import data.generic.k8s as k8sLib
 
 CxPolicy[result] {
 	resource := input.document[i]
+	metadata := resource.metadata
 	specInfo := k8sLib.getSpecInfo(resource)
 	types := {"initContainers", "containers"}
 	container := specInfo.spec[types[x]][j]
@@ -15,7 +16,7 @@ CxPolicy[result] {
 
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("spec.command", []),
+		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.command", [metadata.name, specInfo.path, types[x], container.name]),
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": "--rotate-certificates flag to be true",
 		"keyActualValue": "--rotate-certificates flag is false",

assets/queries/k8s/kubelet_not_managing_ip_tables/query.rego

@@ -16,7 +16,7 @@ CxPolicy[result] {
 
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("spec.command", []),
+		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.command", [metadata.name, specInfo.path, types[x], container.name]),
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": "--make-iptables-util-chains flag to be true",
 		"keyActualValue": "--make-iptables-util-chains= flag is false",

assets/queries/k8s/kubelet_server_periodic_certificate_switch_disabled/metadata.json → assets/queries/k8s/rotate_kubelet_server_certificate_not_active/metadata.json

@@ -1,9 +1,9 @@
 {
     "id": "1c621b8e-2c6a-44f5-bd6a-fb0fb7ba33e2",
-    "queryName": "Kubelet Server Periodic Certificate Switch Disabled",
+    "queryName": "Rotate Kubelet Server Certificate Not Active",
     "severity": "MEDIUM",
     "category": "Secret Management",
-    "descriptionText": "Kubelet argument RotateKubeletServerCertificate should be true",
+    "descriptionText": "The RotateKubeletServerCertificate argument should be true",
     "descriptionUrl": "https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/",
     "platform": "Kubernetes",
     "descriptionID": "a4f48785"

assets/queries/k8s/kubelet_server_periodic_certificate_switch_disabled/query.rego → assets/queries/k8s/rotate_kubelet_server_certificate_not_active/query.rego

@@ -3,19 +3,23 @@ package Cx
 import data.generic.common as common_lib
 import data.generic.k8s as k8sLib
 
+commandList = {"kubelet", "kube-controller-manager"}
+
 CxPolicy[result] {
 	resource := input.document[i]
+	metadata := resource.metadata
 	specInfo := k8sLib.getSpecInfo(resource)
 	types := {"initContainers", "containers"}
 	container := specInfo.spec[types[x]][j]
-	command := "kubelet"
+	command := commandList[_]
 
 	common_lib.inArray(container.command, command)
-	k8sLib.hasFlag(container, "--feature-gates=RotateKubeletServerCertificate=false")
+	k8sLib.startWithFlag(container,"--feature-gates=")
+	contains_feature(container, "RotateKubeletServerCertificate=false")
 
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("spec.command", []),
+		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.command", [metadata.name, specInfo.path, types[x], container.name]),
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": "--feature-gates=RotateKubeletServerCertificate flag to be true",
 		"keyActualValue": "--feature-gates=RotateKubeletServerCertificate flag is false",
@@ -37,3 +41,14 @@ CxPolicy[result] {
 		"keyActualValue": "RotateKubeletServerCertificate is false",
 	}
 }
+
+
+contains_feature(container, feature){
+	contains_in_array(container.command, feature)
+} else {
+	contains_in_array(container.args, feature)
+}
+
+contains_in_array(arr, item) {
+    contains(arr[_], item)
+}

assets/queries/k8s/rotate_kubelet_server_certificate_not_active/test/positive4.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: command-demo
+  labels:
+    purpose: demonstrate-command
+spec:
+  containers:
+    - name: command-demo-container7
+      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
+      command: ["kube-controller-manager"]
+      args: ["--feature-gates=RotateKubeletServerCertificate=false"]
+  restartPolicy: OnFailure

assets/queries/k8s/rotate_kubelet_server_certificate_not_active/test/positive_expected_result.json

@@ -0,0 +1,25 @@
+[
+	{
+		"queryName": "Rotate Kubelet Server Certificate Not Active",
+		"severity": "MEDIUM",
+		"line": 8,
+        "filename": "positive1.yaml"
+	},
+    {
+		"queryName": "Rotate Kubelet Server Certificate Not Active",
+		"severity": "MEDIUM",
+		"line": 11,
+        "filename": "positive2.yaml"
+	},
+    {
+		"queryName": "Rotate Kubelet Server Certificate Not Active",
+		"severity": "MEDIUM",
+		"line": 8,
+        "filename": "positive3.json"
+	},{
+		"queryName": "Rotate Kubelet Server Certificate Not Active",
+		"severity": "MEDIUM",
+		"line": 11,
+        "filename": "positive4.yaml"
+	}
+]