add support VMware Tanzu(TKGI) Benchmarks v1.2.53 (#1452)

* add Support VMware Tanzu(TKGI) Benchmarks v1.2.53
with this change, we are adding
1. latest kubernetes cis benchmarks for VMware Tanzu1.2.53
2. logic to kube-bench so that kube-bench can auto detect vmware platform, will be able to execute the respective vmware tkgi compliance checks.
3. job-tkgi.yaml file to run the benchmark as a job in tkgi cluster
Reference Document for checks: https://network.pivotal.io/products/p-compliance-scanner/#/releases/1248397

* add Support VMware Tanzu(TKGI) Benchmarks v1.2.53
with this change, we are adding
1. latest kubernetes cis benchmarks for VMware Tanzu1.2.53
2. logic to kube-bench so that kube-bench can auto detect vmware platform, will be able to execute the respective vmware tkgi compliance checks.
3. job-tkgi.yaml file to run the benchmark as a job in tkgi cluster
Reference Document for checks: https://network.pivotal.io/products/p-compliance-scanner/#/releases/1248397

Author: KiranBodipi

cfg/config.yaml

@@ -270,6 +270,7 @@ version_mapping:
   "aks-1.0": "aks-1.0"
   "ack-1.0": "ack-1.0"
   "cis-1.6-k3s": "cis-1.6-k3s"
+  "tkgi-1.2.53": "tkgi-1.2.53"
 
 target_mapping:
   "cis-1.5":
@@ -372,3 +373,9 @@ target_mapping:
     - "controlplane"
     - "policies"
     - "managedservices"
+  "tkgi-1.2.53":
+    - "master"
+    - "etcd"
+    - "controlplane"
+    - "node"
+    - "policies"

cfg/tkgi-1.2.53/config.yaml

@@ -0,0 +1,2 @@
+---
+## Version-specific settings that override the values in cfg/config.yaml

cfg/tkgi-1.2.53/controlplane.yaml

@@ -0,0 +1,67 @@
+---
+controls:
+version: "tkgi-1.2.53"
+id: 3
+text: "Control Plane Configuration"
+type: "controlplane"
+groups:
+  - id: 3.1
+    text: "Authentication and Authorization"
+    checks:
+      - id: 3.1.1
+        text: "Client certificate authentication should not be used for users"
+        audit: ps -ef | grep kube-apiserver | grep -- "--oidc-issuer-url="
+        type: "manual"
+        remediation: |
+          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
+          implemented in place of client certificates.
+          Exception
+          This setting is site-specific. It can be set in the "Configure created clusters to use UAA as the OIDC provider."
+          section of the "UAA"
+        scored: false
+
+  - id: 3.2
+    text: "Logging"
+    checks:
+      - id: 3.2.1
+        text: "Ensure that a minimal audit policy is created"
+        audit: ps -ef | grep kube-apiserver | grep -v tini | grep -- "--audit-policy-file="
+        tests:
+          test_items:
+            - flag: "--audit-policy-file"
+        remediation: |
+          Create an audit policy file for your cluster.
+        scored: true
+
+      - id: 3.2.2
+        text: "Ensure that the audit policy covers key security concerns"
+        audit: |
+          diff /var/vcap/jobs/kube-apiserver/config/audit_policy.yml \ <(echo "--- apiVersion: audit.k8s.io/v1beta1 kind:
+          Policy rules: - level: None resources: - group: '' resources: - endpoints - services - services/status users: -
+          system:kube-proxy verbs: - watch - level: None resources: - group: '' resources: - nodes - nodes/status users: -
+          kubelet verbs: - get - level: None resources: - group: '' resources: - nodes - nodes/status userGroups: -
+          system:nodes verbs: - get - level: None namespaces: - kube-system resources: - group: '' resources: -
+          endpoints users: - system:kube-controller-manager - system:kube-scheduler - system:serviceaccount:kube-
+          system:endpoint-controller verbs: - get - update - level: None resources: - group: '' resources: - namespaces -
+          namespaces/status - namespaces/finalize users: - system:apiserver verbs: - get - level: None resources: -
+          group: metrics.k8s.io users: - system:kube-controller-manager verbs: - get - list - level: None
+          nonResourceURLs: - \"/healthz*\" - \"/version\" - \"/swagger*\" - level: None resources: - group: '' resources: -
+          events - level: Request omitStages: - RequestReceived resources: - group: '' resources: - nodes/status -
+          pods/status userGroups: - system:nodes verbs: - update - patch - level: Request omitStages: -
+          RequestReceived users: - system:serviceaccount:kube-system:namespace-controller verbs: - deletecollection -
+          level: Metadata omitStages: - RequestReceived resources: - group: '' resources: - secrets - configmaps - group:
+          authentication.k8s.io resources: - tokenreviews - level: Request omitStages: - RequestReceived resources: -
+          group: '' - group: admissionregistration.k8s.io - group: apiextensions.k8s.io - group: apiregistration.k8s.io -
+          group: apps - group: authentication.k8s.io - group: authorization.k8s.io - group: autoscaling - group: batch -
+          group: certificates.k8s.io - group: extensions - group: metrics.k8s.io - group: networking.k8s.io - group: policy -
+          group: rbac.authorization.k8s.io - group: settings.k8s.io - group: storage.k8s.io verbs: - get - list - watch - level:
+          RequestResponse omitStages: - RequestReceived resources: - group: '' - group: admissionregistration.k8s.io -
+          group: apiextensions.k8s.io - group: apiregistration.k8s.io - group: apps - group: authentication.k8s.io - group:
+          authorization.k8s.io - group: autoscaling - group: batch - group: certificates.k8s.io - group: extensions - group:
+          metrics.k8s.io - group: networking.k8s.io - group: policy - group: rbac.authorization.k8s.io - group:
+          settings.k8s.io - group: storage.k8s.io - level: Metadata omitStages: - RequestReceived ")
+        type: "manual"
+        remediation: |
+          Consider modification of the audit policy in use on the cluster to include these items, at a
+          minimum.
+        scored: false

cfg/tkgi-1.2.53/etcd.yaml

@@ -0,0 +1,121 @@
+---
+controls:
+version: "tkgi-1.2.53"
+id: 2
+text: "Etcd Node Configuration"
+type: "etcd"
+groups:
+  - id: 2
+    text: "Etcd Node Configuration Files"
+    checks:
+      - id: 2.1
+        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate"
+        audit: ps -ef | grep etcd | grep -- "--cert-file=/var/vcap/jobs/etcd/config/etcd.crt" | grep -- "--key-file=/var/vcap/jobs/etcd/config/etcd.key"
+        type: manual
+        tests:
+          bin_op: and
+          test_items:
+            - flag: "--cert-file"
+            - flag: "--key-file"
+        remediation: |
+          Follow the etcd service documentation and configure TLS encryption.
+          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
+          on the master node and set the below parameters.
+          --cert-file=</path/to/ca-file>
+          --key-file=</path/to/key-file>
+        scored: false
+
+      - id: 2.2
+        text: "Ensure that the --client-cert-auth argument is set to true"
+        audit: ps -ef | grep etcd | grep -- "--client\-cert\-auth"
+        tests:
+          test_items:
+            - flag: "--client-cert-auth"
+              compare:
+                op: eq
+                value: true
+        remediation: |
+          Edit the etcd pod specification file etcd config on the master
+          node and set the below parameter.
+          --client-cert-auth="true"
+        scored: true
+
+      - id: 2.3
+        text: "Ensure that the --auto-tls argument is not set to true"
+        audit: ps -ef | grep etcd | grep -v -- "--auto-tls"
+        tests:
+          test_items:
+            - flag: "--auto-tls"
+              compare:
+                op: eq
+                value: true
+              set: false
+        remediation: |
+          Edit the etcd pod specification file etcd config on the master
+          node and either remove the --auto-tls parameter or set it to false.
+            --auto-tls=false
+        scored: true
+
+      - id: 2.4
+        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate"
+        audit: ps -ef | grep etcd | grep -- "--peer-cert-file=/var/vcap/jobs/etcd/config/peer.crt" | grep -- "--peer-key-file=/var/vcap/jobs/etcd/config/peer.key"
+        type: manual
+        tests:
+          bin_op: and
+          test_items:
+            - flag: "--peer-cert-file"
+            - flag: "--peer-key-file"
+        remediation: |
+          Follow the etcd service documentation and configure peer TLS encryption as appropriate
+          for your etcd cluster.
+          Then, edit the etcd pod specification file etcd config on the
+          master node and set the below parameters.
+          --peer-client-file=</path/to/peer-cert-file>
+          --peer-key-file=</path/to/peer-key-file>
+        scored: false
+
+      - id: 2.5
+        text: "Ensure that the --peer-client-cert-auth argument is set to true"
+        audit: ps -ef | grep etcd | grep -- "--peer\-client\-cert\-auth"
+        tests:
+          test_items:
+            - flag: "--peer-client-cert-auth"
+              compare:
+                op: eq
+                value: true
+        remediation: |
+          Edit the etcd pod specification file etcd config on the master
+          node and set the below parameter.
+          --peer-client-cert-auth=true
+        scored: true
+
+      - id: 2.6
+        text: "Ensure that the --peer-auto-tls argument is not set to true"
+        audit: ps -ef | grep etcd | grep -v -- "--peer-auto-tls"
+        tests:
+          test_items:
+            - flag: "--peer-auto-tls"
+              compare:
+                op: eq
+                value: true
+              set: false
+        remediation: |
+          Edit the etcd pod specification file etcd config on the master
+          node and either remove the --peer-auto-tls parameter or set it to false.
+          --peer-auto-tls=false
+        scored: true
+
+      - id: 2.7
+        text: "Ensure that a unique Certificate Authority is used for etcd"
+        audit: diff /var/vcap/jobs/kube-apiserver/config/kubernetes-ca.pem /var/vcap/jobs/etcd/config/etcd-ca.crt | grep -c"^>" | grep -v "^0$"
+        type: manual
+        tests:
+          test_items:
+            - flag: "--trusted-ca-file"
+        remediation: |
+          Follow the etcd documentation and create a dedicated certificate authority setup for the
+          etcd service.
+          Then, edit the etcd pod specification file etcd config on the
+          master node and set the below parameter.
+          --trusted-ca-file=</path/to/ca-file>
+        scored: false