ETCD results not showing

[Richahasija]

I am running kubernetes version Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.3"
Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.3", Platform:"linux/amd64"}

I am trying to run kube bench in a Kubernetes cluster via below command:
kubectl apply -f job.yaml
Kubernetes logs are not showing etcd and Control Plane Configuration results(i.e. subsection 2 and 3 of CIS_Kubernetes_Benchmark_v1.5). Not sure what could be the reason. Could you please help?

[mozillazg]

@Richahasija The etcd is running on master, it looks like you should use kubectl apply -f job-master.yaml

[Richahasija]

@mozillazg : I already did that as well and it's only checking for subsection1. One thing to note is my etcd has configuration file path /etc/etcd/etcd.conf.
I also think it is taking file as /etc/kubernetes/manifests/etcd.yaml instead of /etc/etcd/etcd.conf.
Tried updating /cfg/cis-1.5/config.yaml . But issue remains same, It's not checking for sub section 2 and 3.

[mozillazg]

Set -v 10 --logtostderr command line options and save the log output. Please paste this into your issue.
https://github.com/aquasecurity/kube-bench#bugs

@Richahasija What is the output when open the debug mode?

[Richahasija]

@mozillazg : I have ran the command. But not sure still, as to what is the issue. Attaching the log output for your kind reference.
etcd_error.txt

[lizrice]

@Richahasija you need to add the -v 10 --logtostderr options to the command configured in the job-master.yaml file, and send the log output from that Kubernetes job

[Richahasija]

@lizrice : Have ran it again as per mentioned above. It seems like it is taking default config as /etc/kubernetes/manifests/etcd.yaml instead of /etc/etcd/etcd.conf.
But not sure, how to resolve it

ETCD_Error_new.txt

[Richahasija]

@lizrice & @mozillazg: Any update on the issue.

[lizrice]

In the cfg directory you should see a config.yaml file which includes a section like this:

etcd:
    optional: true
    bins:
      - "etcd"
    confs:
      - /etc/kubernetes/manifests/etcd.yaml
      - /etc/kubernetes/manifests/etcd.yml
      - /etc/kubernetes/manifests/etcd.manifest
      - /etc/etcd/etcd.conf
      - /var/snap/etcd/common/etcd.conf.yml
      - /var/snap/etcd/common/etcd.conf.yaml
      - /var/snap/microk8s/current/args/etcd
    defaultconf: /etc/kubernetes/manifests/etcd.yaml

The confs part of this is a list of locations that kube-bench will check for, taking the first one that exists as the location of the etcd config file. But from the logs, it's not finding any of those files and it's falling back to the default config location (specified by defaultconf at the end of that section above.)

In the sample job-master.yaml there are some volume mounts that allow kube-bench to access files on the host. In order to access a file in /etc/etcd this volume will need to be mounted as well.

Please could you try modifying job-master.yaml to add a volumeMount like this:

            - name: etc-etcd
              mountPath: /etc/etcd
              readOnly: true

and the corresponding volume like this:

        - name: etc-etcd
          hostPath:
            path: "/etc/etcd"

[Richahasija]

@lizrice : Thanks for updating. After updating the job-master.yaml configuration, it seems etcd new configuration is updated but still kubernetes logs are not showing etcd and Control Plane Configuration results(i.e. subsection 2 and 3 of CIS_Kubernetes_Benchmark_v1.5).
Attaching log file for your kind reference.
Etcd_03_06_2020.txt

[lizrice]

I've realised that the CIS benchmark assumes that etcd is running as a Kubernetes pod, and I don't think that's the case for you. I've raised a ticket about it on the benchmark spec.