Overview
[A clear and concise description of what the bug is]
How did you run kube-bench?
#kubectl -f https://github.com/aquasecurity/kube-bench/blob/main/job.yaml
[Please specify exactly how you ran kube-bench, including details of command parameters and/or job file that you used to run it]
What happened?
on openSuSE, we created the kubelet service under /usr/lib/systemd/system/kubelet.service
...
[FAIL] 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)
....
== Remediations node ==
4.1.1 Run the below command (based on the file location on your system) on the each worker node.
For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
...
[Please include output from the report to illustrate the problem. If possible please supply logs generated with the -v 3 parameter.]
What did you expect to happen:
kube-bench should be able to check the kubelet.service under /usr/lib/systemd/system/kubelet.service, as we checked on ubuntu, it is workable as on ubunutu, /lib -> /usr/lib, but on openSuSE, /lib and /usr/lib are seperated difrectory, whlie kube-bench only mount /lib and failed to read /usr/lib/...
[Please describe what you expected to happen differently.]
kube-bench should find the /usr/lib/systemd/system/kubelet.service on opensuse as well, not reporting FAIL.
Environment
worker node: OpenSuSE
[What is your version of kube-bench? (run kube-bench version)]
0.16.0
[What is your version of Kubernetes? (run kubectl version or oc version on OpenShift.)]
from 1.28-1.36
Running processes
[Please include the output from running ps -eaf | grep kube on the affected node. This will allow us to check what Kubernetes processes are running, and how this compares to what kube-bench detected.]
Configuration files
[If kube-bench is reporting an issue related to the settings defined in a config file, please attach the file, or include an extract showing the settings that are being detected incorrectly.]
Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
Overview
[A clear and concise description of what the bug is]
How did you run kube-bench?
#kubectl -f https://github.com/aquasecurity/kube-bench/blob/main/job.yaml
[Please specify exactly how you ran kube-bench, including details of command parameters and/or job file that you used to run it]
What happened?
on openSuSE, we created the kubelet service under /usr/lib/systemd/system/kubelet.service
...
[FAIL] 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)
....
== Remediations node ==
4.1.1 Run the below command (based on the file location on your system) on the each worker node.
For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
...
[Please include output from the report to illustrate the problem. If possible please supply logs generated with the
-v 3parameter.]What did you expect to happen:
kube-bench should be able to check the kubelet.service under /usr/lib/systemd/system/kubelet.service, as we checked on ubuntu, it is workable as on ubunutu, /lib -> /usr/lib, but on openSuSE, /lib and /usr/lib are seperated difrectory, whlie kube-bench only mount /lib and failed to read /usr/lib/...
[Please describe what you expected to happen differently.]
kube-bench should find the /usr/lib/systemd/system/kubelet.service on opensuse as well, not reporting FAIL.
Environment
worker node: OpenSuSE
[What is your version of kube-bench? (run
kube-bench version)]0.16.0
[What is your version of Kubernetes? (run
kubectl versionoroc versionon OpenShift.)]from 1.28-1.36
Running processes
[Please include the output from running
ps -eaf | grep kubeon the affected node. This will allow us to check what Kubernetes processes are running, and how this compares to what kube-bench detected.]Configuration files
[If kube-bench is reporting an issue related to the settings defined in a config file, please attach the file, or include an extract showing the settings that are being detected incorrectly.]
Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]