virtualgarden.yaml

providers:               # contains information about known providers
- id: virtualgarden      # unique provider identifier
  name: "Virtual Garden" # user friendly name of the provider
  metadata:
    foo: bar
  args:
    # additionalOpsPodLabels: # pod labels that will be added to diki ops pods
    #   foo: bar
    runtimeKubeconfigPath: /tmp/runtime.config  # path to runtime cluster admin kubeconfig
  rulesets:
  - id: disa-kubernetes-stig
    name: DISA Kubernetes Security Technical Implementation Guide
    version: v2r1
    # args:
    #   maxRetries: 1 # number of maximum rule run retries. Defaults to 1 
    ruleOptions:
    # - ruleID: "242376"
    #   skip:
    #     enabled: true
    #     justification: "the whole rule is accepted for ... reasons"
    - ruleID: "242445"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "242446"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "242451"
      args:
        expectedFileOwner:
          # users and groups default to ["0"]
          #
          # Gardener images use distroless nonroot user with ID 65532
          # https://github.com/GoogleContainerTools/distroless/blob/main/base/base.bzl#L8
          users: ["0", "65532"]
          groups: ["0", "65532"]
    - ruleID: "245543"
      args:
        acceptedTokens:
        - user: "health-check"
          uid: "health-check"
          # groups: "group1,group2,group3"
# metadata: # optional, additional metadata to be added to summary json report
#   foo: bar
#   bar:
#     foo: bar
output:
  path: /tmp/test-output.json # optional, path to summary json report. If --output flag is set this configuration is ignored
  minStatus: Passed