1.2.26 test is always passing

[yoavrotems]

https://github.com/aquasecurity/kube-bench/blob/master/cfg/cis-1.5/master.yaml#L745
This currently check if the value exist or if its not exist, one of them will always be true.

[yoavrotems]

@lizrice I think maybe this test should be manual, since is changing per system, and there isn't any recommendation but just an example of what to set (300).
WDYT?

[lizrice]

The test we have is definitely wrong! I agree, as worded this can't be automated and I've raised a ticket about it with CIS. For now perhaps the best thing is to mark it as Manual.

[davidhay1969]

Hey @lizrice @yoavrotems interestingly, I've just started seeing 1.2.26 being marked as [WARN] having rebuilt my kube-bench image from the main branch of kube-bench showing up as: -

I0526 14:40:09.158954   31290 check.go:110] -----   Running check 1.2.26   -----
I0526 14:40:09.158966   31290 check.go:133] Test marked as a manual test

[WARN] 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated)

== Remediations master ==
1.2.26 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
and set the below parameter as appropriate and if needed.
For example,
--request-timeout=300s

I'm guessing that this is a result of this PR

Whilst I can easily configure KB to skip the test via --skip=1.2.26 I'm wondering whether CIS ever responded, given that their guidelines: -

Description:
Set global request timeout for API server requests as appropriate.
Rationale:
Setting global request timeout allows extending the API server request timeout limit to a duration appropriate to the user's connection speed. By default, it is set to 60 seconds which might be problematic on slower connections making cluster resources inaccessible once the data volume for requests exceeds what can be transmitted in 60 seconds. But, setting this timeout limit to be too large can exhaust the API server resources making it prone to Denial-of-Service attack. Hence, it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed.

aren't terribly clear 😢

Could we, for example, test for the existence of --request-timeout and, if it's found, throw a warning IF it's anything other than 60 i.e. "DANGER, WILL ROBINSON 🤖 " ?

Just a thought ....

[davidhay1969]

If so, happy to have a go !