turbot/steampipe-mod-kubernetes-compliance

Control: Replication Controller containers argument kubelet HTTPS should be enabled

Description

This check ensures that the container in the Replication Controller has kubelet HTTPS argument enabled.

Usage

Run the control in your terminal:

powerpipe control run kubernetes_compliance.control.replication_controller_container_argument_kubelet_https_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run kubernetes_compliance.control.replication_controller_container_argument_kubelet_https_enabled --share

SQL

This control uses a named query:

select
coalesce(uid, concat(path, ':', start_line)) as resource,
case
when (c -> 'command') is null or not ((c -> 'command') @> '["kube-apiserver"]') then 'ok'
when (c -> 'command') @> '["kube-apiserver"]'
and (c -> 'command') @> '["--kubelet-https=false"]' then 'alarm'
else 'ok'
end as status,
case
when (c -> 'command') is null then c ->> 'name' || ' command not defined.'
when not ((c -> 'command') @> '["kube-apiserver"]') then c ->> 'name' || ' kube-apiserver not defined.'
when (c -> 'command') @> '["kube-apiserver"]'
and (c -> 'command') @> '["--kubelet-https=false"]' then c ->> 'name' || ' kubelet HTTPS disabled.'
else c ->> 'name' || ' kubelet HTTPS enabled.'
end as reason,
name as replication_controller_name
, coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as path
from
kubernetes_replication_controller,
jsonb_array_elements(template -> 'spec' -> 'containers') as c;

Tags