diki/example/config/virtualgarden.yaml at main · gardener/diki · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
providers:               # contains information about known providers
- id: virtualgarden      # unique provider identifier
  name: "Virtual Garden" # user friendly name of the provider
  metadata:
    foo: bar
  args:
    # additionalOpsPodLabels: # pod labels that will be added to diki ops pods
    #   foo: bar
    runtimeKubeconfigPath: /tmp/runtime.config  # path to runtime cluster admin kubeconfig
  rulesets:
  - id: disa-kubernetes-stig
    name: DISA Kubernetes Security Technical Implementation Guide
    version: v2r5
    # args:
    #   maxRetries: 1 # number of maximum rule run retries. Defaults to 1
    ruleOptions:
    # - ruleID: "242376"
    #   skip:
    #     enabled: true
    #     justification: "the whole rule is accepted for ... reasons"
    # - ruleID: "242390"
    #   args:
    #     acceptedEndpoints:
    #     - path: /healthz
    #     - path: /livez
    # - ruleID: "242442"
    #   args:
    #     expectedVersionedImages:
    #     - name: "eu.gcr.io/foo"
    #     - name: "eu.gcr.io/bar"
    - ruleID: "242445"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "242446"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "242451"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "245543"
      args:
        acceptedTokens:
        - user: "health-check"
          uid: "health-check"
          # groups: "group1,group2,group3"
# metadata: # optional, additional metadata to be added to summary json report
#   foo: bar
#   bar:
#     foo: bar
output:
  path: /tmp/test-output.json # optional, path to summary json report. If --output flag is set this configuration is ignored
  minStatus: Passed