Add config settings for OpenShift

[lizrice]

Openshift uses different binaries and config file locations, and I'm opening this issue to gauge interest in adding Openshift config to kube-bench.

OpenShift has its own approach to security, and doesn't directly expose a lot of the config arguments of kube-bench making a lot of the CIS Benchmark tests seem mostly irrelevant.

However, "all kubelet settings that have corresponding command-line flags can already be set using the kubeletArguments map in the node config file, with the caveat that it can result in insecure, untested, and/or invalid configurations".

It would also be possible to at least check for things like file permissions.

• Config files live in /etc/origin/master and /etc/origin/node directories (for master & node respectively)
• Executables are openshift start node and openshift start master

[vamsi1122]

It will be very helpful if this make it happen. As most of the companies are moving towards Container Platform. Especially, Openshift being top in the game.

[sands6]

Yes, this enhancement is required for us to continue our work with Kube-bench on Openshift

[lizrice]

There is now a plan to document how the CIS benchmarks would need to be adapted to apply to OpenShift - once that's in place we can create kube-bench tests to match.

[kawai888]

cool, looking forward to using it for our openshift post deployment check

[lizrice]

Work is actively in progress on making the OpenShift checks now

[lizrice]

work in progress under #212

[agvikashsagar]

It will be helpful one

[lizrice]

The config files are there now so you should be able to give this a try by specifying --version ocp-3.10

[dineshtripathi30]

Can you please help me with full command to execute ocp checks?

[ttousai]

@pedaas on your k8s cluster master run:

docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install
./kube-bench master --version ocp-3.10