2022-11-10 11:35:47,669 - xtesting.ci.run_tests - INFO - Deployment description:
+-------------------------+----------------------------------------------------------+
| ENV VAR | VALUE |
+-------------------------+----------------------------------------------------------+
| CI_LOOP | daily |
| DEBUG | false |
| DEPLOY_SCENARIO | k8-nosdn-nofeature-noha |
| INSTALLER_TYPE | unknown |
| BUILD_TAG | |
| NODE_NAME | |
| TEST_DB_URL | http://testresults.opnfv.org/test/api/v1/results |
| TEST_DB_EXT_URL | |
| S3_ENDPOINT_URL | |
| S3_DST_URL | |
| HTTP_DST_URL | |
+-------------------------+----------------------------------------------------------+
2022-11-10 11:35:47,685 - xtesting.ci.run_tests - INFO - Loading test case 'kube_bench_node'...
2022-11-10 11:35:47,991 - xtesting.ci.run_tests - INFO - Running test case 'kube_bench_node'...
2022-11-10 11:35:54,758 - functest_kubernetes.security.security - ERROR - Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
Run the below command (based on the file location on your system) on the each worker node.
For example,
chmod 644 /etc/kubernetes/proxy.conf
2022-11-10 11:35:54,759 - functest_kubernetes.security.security - ERROR - Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
Run the below command (based on the file location on your system) on the each worker node.
For example, chown root:root /etc/kubernetes/proxy.conf
2022-11-10 11:35:54,759 - functest_kubernetes.security.security - ERROR - Ensure that the --read-only-port argument is set to 0 (Scored)
If using a Kubelet config file, edit the file to set readOnlyPort to 0.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--read-only-port=0
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
2022-11-10 11:35:54,759 - functest_kubernetes.security.security - ERROR - Ensure that the --protect-kernel-defaults argument is set to true (Scored)
If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--protect-kernel-defaults=true
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
2022-11-10 11:35:54,759 - functest_kubernetes.security.security - ERROR - Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
If using a Kubelet config file, edit the file to set tlsCertFile to the location
of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile
to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
2022-11-10 11:35:54,760 - functest_kubernetes.security.security - WARNING - Targets:
+-------------------+-----------------+-----------------------------------------+--------------+--------------+--------------+
| NODE_TYPE | VERSION | TEST_DESC | PASS | FAIL | WARN |
+-------------------+-----------------+-----------------------------------------+--------------+--------------+--------------+
| node | 1.5 | Worker Node Configuration Files | 7 | 2 | 1 |
| node | 1.5 | Kubelet | 8 | 3 | 2 |
+-------------------+-----------------+-----------------------------------------+--------------+--------------+--------------+
2022-11-10 11:35:54,760 - xtesting.ci.run_tests - INFO - Test result:
+-------------------------+------------------+------------------+----------------+
| TEST CASE | PROJECT | DURATION | RESULT |
+-------------------------+------------------+------------------+----------------+
| kube_bench_node | functest | 00:06 | PASS |
+-------------------------+------------------+------------------+----------------+
2022-11-10 11:35:54,816 - xtesting.ci.run_tests - INFO - Execution exit value: Result.EX_OK4
|