gardener.yaml

providers:             # contains information about known providers
- id: gardener         # unique provider identifier
  name: Gardener       # user friendly name of the provider
  metadata:
    projectName: local
    shootName: local
    # foo: bar
  args:
    # additionalOpsPodLabels: # pod labels that will be added to diki ops pods
    #   foo: bar
    shootKubeconfigPath: /tmp/shoot.config  # path to shoot admin kubeconfig
    seedKubeconfigPath: /tmp/seed.config    # path to seed admin kubeconfig
    shootName: local                           # name of shoot cluster to be tested
    shootNamespace: shoot--local--local        # name of namespace which contains the shoot controlplane residing in the seed cluster
  rulesets:
  - id: disa-kubernetes-stig
    name: DISA Kubernetes Security Technical Implementation Guide
    version: v2r1
    # args:
    #   maxRetries: 1 # number of maximum rule run retries. Defaults to 1 
    ruleOptions:
    # - ruleID: "242376"
    #   skip:
    #     enabled: true
    #     justification: "the whole rule is accepted for ... reasons"
    # - ruleID: "242400"
    #   args:
    #     kubeProxyDisabled: true # skip kube-proxy check
    - ruleID: "242414"
      args:
        acceptedPods:
        - podMatchLabels:
            k8s-app: node-local-dns
          namespaceMatchLabels:
            kubernetes.io/metadata.name: kube-system
          justification: "node local dns is allowed because of special handling!"
          ports:
          - 53
        - podMatchLabels:
            app: node-problem-detector
          namespaceMatchLabels:
            kubernetes.io/metadata.name: kube-system
          ports:
          - 1011
          - 1012
    # - ruleID: "242415"
    #   args:
    #     acceptedPods:
    #     - podMatchLabels:
    #         label: foo
    #       namespaceMatchLabels:
    #         label: foo
    #       justification: "justification"
    #       environmentVariables:
    #       - FOO_BAR
    - ruleID: "242445"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "242446"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "242451"
      args:
        # kubeProxyDisabled: true
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    # - ruleID: "242466"
    #   args:
    #     kubeProxyDisabled: true # skip kube-proxy check
    # - ruleID: "242467"
    #   args:
    #     kubeProxyDisabled: true # skip kube-proxy check
    - ruleID: "245543"
      args:
        acceptedTokens:
        - user: "health-check"
          uid: "health-check"
          # groups: "group1,group2,group3"
    - ruleID: "254800"
      args:
        minPodSecurityStandardsProfile: "baseline"  # if set it will indicate the min Pod Security Standards profile that is allowed. Possible values are "privileged", "baseline" and "restricted". 
# metadata: # optional, additional metadata to be added to summary json report
#   foo: bar
#   bar:
#     foo: bar
output:
  path: /tmp/test-output.json # optional, path to summary json report. If --output flag is set this configuration is ignored
  minStatus: Passed