Closed taylorjstacey closed 2 years ago
Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).
:memo: Please visit https://cla.developers.google.com/ to sign.
Once you've signed (or fixed any issues), please reply here with @googlebot I signed it!
and we'll verify it.
ℹ️ Googlers: Go here for more info.
@googlebot I signed it!
Thanks a lot Taylor for this pull request and welcome to the project!
this is CIS 6.8.3 https://cloud.google.com/kubernetes-engine/docs/concepts/cis-benchmarks so I would suggest we take this rule. The only question is how to categorize it so it wouldn't be too noisy.
@schweikert do you think we might need another category of rules? Maybe CIS as a category by itself?
Added tests as needed and I greatly reduced to the text in the webpage summary for BP/2021_02 to make it more actionable.
Took @schweikert's note on the unnecessary list and removed that step.
This pull request includes three changes.
has_authenticator_group_enabled
to the GKE query class. This checks to see if the['authenticatorGroupsConfig']['enabled']
key exists. If authentictor groups were previously enabled, the previously used gke-security-groups email will persist but the enabled key will disappear.