2020-03-29 01:03:01,933 - xtesting.ci.run_tests - INFO - Deployment description:

+-------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+
|         ENV VAR         |                                                                        VALUE                                                                         |
+-------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+
|         CI_LOOP         |                                                                        daily                                                                         |
|          DEBUG          |                                                                         true                                                                         |
|     DEPLOY_SCENARIO     |                                                               k8-nosdn-nofeature-noha                                                                |
|      INSTALLER_TYPE     |                                                                       unknown                                                                        |
|        BUILD_TAG        |                                                                     CMXUDVRMTNJO                                                                     |
|        NODE_NAME        |                                                                     lf-virtual8                                                                      |
|       TEST_DB_URL       |                                                   http://testresults.opnfv.org/test/api/v1/results                                                   |
|     TEST_DB_EXT_URL     |                                                   http://testresults.opnfv.org/test/api/v1/results                                                   |
|     S3_ENDPOINT_URL     |                                                            https://storage.googleapis.com                                                            |
|        S3_DST_URL       |      s3://artifacts.opnfv.org/functest-kubernetes/CMXUDVRMTNJO/functest-kubernetes-opnfv-functest-kubernetes-security-latest-kube_hunter-run-15      |
|       HTTP_DST_URL      |     http://artifacts.opnfv.org/functest-kubernetes/CMXUDVRMTNJO/functest-kubernetes-opnfv-functest-kubernetes-security-latest-kube_hunter-run-15     |
+-------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+

2020-03-29 01:03:01,938 - xtesting.ci.run_tests - DEBUG - No env file /var/lib/xtesting/conf/env_file found
2020-03-29 01:03:01,939 - xtesting.ci.run_tests - DEBUG - Test args: kube_hunter
2020-03-29 01:03:01,945 - xtesting.ci.run_tests - INFO - Loading test case 'kube_hunter'...
2020-03-29 01:03:02,236 - xtesting.ci.run_tests - INFO - Running test case 'kube_hunter'...
2020-03-29 01:03:02,259 - functest_kubernetes.security.security - INFO - Job kube-hunter created
2020-03-29 01:03:02,259 - functest_kubernetes.security.security - DEBUG - create_namespaced_job: {'api_version': 'batch/v1',
 'kind': 'Job',
 'metadata': {'annotations': None,
              'cluster_name': None,
              'creation_timestamp': datetime.datetime(2020, 3, 29, 1, 3, 2, tzinfo=tzlocal()),
              'deletion_grace_period_seconds': None,
              'deletion_timestamp': None,
              'finalizers': None,
              'generate_name': None,
              'generation': None,
              'initializers': None,
              'labels': {'controller-uid': 'c1557722-c344-4415-bcf2-d55e775fd2c6',
                         'job-name': 'kube-hunter'},
              'managed_fields': None,
              'name': 'kube-hunter',
              'namespace': 'default',
              'owner_references': None,
              'resource_version': '3623382',
              'self_link': '/apis/batch/v1/namespaces/default/jobs/kube-hunter',
              'uid': 'c1557722-c344-4415-bcf2-d55e775fd2c6'},
 'spec': {'active_deadline_seconds': None,
          'backoff_limit': 4,
          'completions': 1,
          'manual_selector': None,
          'parallelism': 1,
          'selector': {'match_expressions': None,
                       'match_labels': {'controller-uid': 'c1557722-c344-4415-bcf2-d55e775fd2c6'}},
          'template': {'metadata': {'annotations': None,
                                    'cluster_name': None,
                                    'creation_timestamp': None,
                                    'deletion_grace_period_seconds': None,
                                    'deletion_timestamp': None,
                                    'finalizers': None,
                                    'generate_name': None,
                                    'generation': None,
                                    'initializers': None,
                                    'labels': {'controller-uid': 'c1557722-c344-4415-bcf2-d55e775fd2c6',
                                               'job-name': 'kube-hunter'},
                                    'managed_fields': None,
                                    'name': None,
                                    'namespace': None,
                                    'owner_references': None,
                                    'resource_version': None,
                                    'self_link': None,
                                    'uid': None},
                       'spec': {'active_deadline_seconds': None,
                                'affinity': None,
                                'automount_service_account_token': None,
                                'containers': [{'args': ['--pod'],
                                                'command': ['python',
                                                            'kube-hunter.py'],
                                                'env': None,
                                                'env_from': None,
                                                'image': 'aquasec/kube-hunter',
                                                'image_pull_policy': 'Always',
                                                'lifecycle': None,
                                                'liveness_probe': None,
                                                'name': 'kube-hunter',
                                                'ports': None,
                                                'readiness_probe': None,
                                                'resources': {'limits': None,
                                                              'requests': None},
                                                'security_context': None,
                                                'stdin': None,
                                                'stdin_once': None,
                                                'termination_message_path': '/dev/termination-log',
                                                'termination_message_policy': 'File',
                                                'tty': None,
                                                'volume_devices': None,
                                                'volume_mounts': None,
                                                'working_dir': None}],
                                'dns_config': None,
                                'dns_policy': 'ClusterFirst',
                                'enable_service_links': None,
                                'host_aliases': None,
                                'host_ipc': None,
                                'host_network': None,
                                'host_pid': None,
                                'hostname': None,
                                'image_pull_secrets': None,
                                'init_containers': None,
                                'node_name': None,
                                'node_selector': None,
                                'preemption_policy': None,
                                'priority': None,
                                'priority_class_name': None,
                                'readiness_gates': None,
                                'restart_policy': 'Never',
                                'runtime_class_name': None,
                                'scheduler_name': 'default-scheduler',
                                'security_context': {'fs_group': None,
                                                     'run_as_group': None,
                                                     'run_as_non_root': None,
                                                     'run_as_user': None,
                                                     'se_linux_options': None,
                                                     'supplemental_groups': None,
                                                     'sysctls': None,
                                                     'windows_options': None},
                                'service_account': None,
                                'service_account_name': None,
                                'share_process_namespace': None,
                                'subdomain': None,
                                'termination_grace_period_seconds': 30,
                                'tolerations': None,
                                'volumes': None}},
          'ttl_seconds_after_finished': None},
 'status': {'active': None,
            'completion_time': None,
            'conditions': None,
            'failed': None,
            'start_time': None,
            'succeeded': None}}
2020-03-29 01:03:20,437 - functest_kubernetes.security.security - INFO - kube-hunter started in 18.20 sec
2020-03-29 01:03:20,481 - functest_kubernetes.security.security - WARNING - 

2020-03-29 01:03:07,408 INFO kube_hunter.modules.report.collector Started hunting
2020-03-29 01:03:07,408 INFO kube_hunter.modules.report.collector Discovering Open Kubernetes Services
2020-03-29 01:03:07,416 INFO kube_hunter.modules.report.collector Found vulnerability "Read access to pod's service account token" in Local to Pod(kube-hunter-bwnzm)
2020-03-29 01:03:07,416 INFO kube_hunter.modules.report.collector Found vulnerability "CAP_NET_RAW Enabled" in Local to Pod(kube-hunter-bwnzm)
2020-03-29 01:03:07,418 INFO kube_hunter.modules.report.collector Found vulnerability "Access to pod's secrets" in Local to Pod(kube-hunter-bwnzm)
2020-03-29 01:03:07,747 INFO kube_hunter.modules.report.collector Found open service "API Server" at 10.96.0.1:443
2020-03-29 01:03:07,801 INFO kube_hunter.modules.report.collector Found open service "Kubelet API" at 10.244.1.1:10250
2020-03-29 01:03:07,814 INFO kube_hunter.modules.report.collector Found vulnerability "K8s Version Disclosure" in 10.96.0.1:443
2020-03-29 01:03:07,845 INFO kube_hunter.modules.report.collector Found vulnerability "Access to API using service account token" in 10.96.0.1:443

Nodes
+-------------+------------+
| TYPE        | LOCATION   |
+-------------+------------+
| Node/Master | 10.244.1.1 |
+-------------+------------+
| Node/Master | 10.96.0.1  |
+-------------+------------+

Detected Services
+-------------+------------------+----------------------+
| SERVICE     | LOCATION         | DESCRIPTION          |
+-------------+------------------+----------------------+
| Kubelet API | 10.244.1.1:10250 | The Kubelet is the   |
|             |                  | main component in    |
|             |                  | every Node, all pod  |
|             |                  | operations goes      |
|             |                  | through the kubelet  |
+-------------+------------------+----------------------+
| API Server  | 10.96.0.1:443    | The API server is in |
|             |                  | charge of all        |
|             |                  | operations on the    |
|             |                  | cluster.             |
+-------------+------------------+----------------------+

Vulnerabilities
For further information about a vulnerability, search its ID in: 
https://github.com/aquasecurity/kube-hunter/tree/master/docs/_kb
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+
| ID     | LOCATION             | CATEGORY             | VULNERABILITY        | DESCRIPTION          | EVIDENCE             |
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+
| KHV005 | 10.96.0.1:443        | Information          | Access to API using  | The API Server port  | b'{"kind":"APIVersio |
|        |                      | Disclosure           | service account      | is accessible.       | ns","versions":["v1" |
|        |                      |                      | token                |     Depending on     | ...                  |
|        |                      |                      |                      | your RBAC settings   |                      |
|        |                      |                      |                      | this could expose    |                      |
|        |                      |                      |                      | access to or control |                      |
|        |                      |                      |                      | of your cluster.     |                      |
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+
| KHV002 | 10.96.0.1:443        | Information          | K8s Version          | The kubernetes       | v1.17.0              |
|        |                      | Disclosure           | Disclosure           | version could be     |                      |
|        |                      |                      |                      | obtained from the    |                      |
|        |                      |                      |                      | /version endpoint    |                      |
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+
| None   | Local to Pod(kube-   | Access Risk          | CAP_NET_RAW Enabled  | CAP_NET_RAW is       |                      |
|        | hunter-bwnzm)        |                      |                      | enabled by default   |                      |
|        |                      |                      |                      | for pods.            |                      |
|        |                      |                      |                      |     If an attacker   |                      |
|        |                      |                      |                      | manages to           |                      |
|        |                      |                      |                      | compromise a pod,    |                      |
|        |                      |                      |                      |     they could       |                      |
|        |                      |                      |                      | potentially take     |                      |
|        |                      |                      |                      | advantage of this    |                      |
|        |                      |                      |                      | capability to        |                      |
|        |                      |                      |                      | perform network      |                      |
|        |                      |                      |                      |     attacks on other |                      |
|        |                      |                      |                      | pods running on the  |                      |
|        |                      |                      |                      | same node            |                      |
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+
| None   | Local to Pod(kube-   | Access Risk          | Access to pod's      |  Accessing the pod's | ['/var/run/secrets/k |
|        | hunter-bwnzm)        |                      | secrets              | secrets within a     | ubernetes.io/service |
|        |                      |                      |                      | compromised pod      | ...                  |
|        |                      |                      |                      | might disclose       |                      |
|        |                      |                      |                      | valuable data to a   |                      |
|        |                      |                      |                      | potential attacker   |                      |
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+
| KHV050 | Local to Pod(kube-   | Access Risk          | Read access to pod's |  Accessing the pod   | eyJhbGciOiJSUzI1NiIs |
|        | hunter-bwnzm)        |                      | service account      | service account      | ImtpZCI6IklmVnZsUzFz |
|        |                      |                      | token                | token gives an       | ...                  |
|        |                      |                      |                      | attacker the option  |                      |
|        |                      |                      |                      | to use the server    |                      |
|        |                      |                      |                      | API                  |                      |
+--------+----------------------+----------------------+----------------------+----------------------+----------------------+


2020-03-29 01:03:20,482 - xtesting.ci.run_tests - INFO - Test result:

+---------------------+------------------+------------------+----------------+
|      TEST CASE      |     PROJECT      |     DURATION     |     RESULT     |
+---------------------+------------------+------------------+----------------+
|     kube_hunter     |     functest     |      00:18       |      PASS      |
+---------------------+------------------+------------------+----------------+

2020-03-29 01:03:20,517 - functest_kubernetes.security.security - DEBUG - delete_namespaced_pod: {'api_version': 'v1',
 'code': None,
 'details': None,
 'kind': 'Pod',
 'message': None,
 'metadata': {'_continue': None,
              'remaining_item_count': None,
              'resource_version': '3623473',
              'self_link': '/api/v1/namespaces/default/pods/kube-hunter-bwnzm'},
 'reason': None,
 'status': "{'phase': 'Succeeded', 'conditions': [{'type': 'Initialized', "
           "'status': 'True', 'lastProbeTime': None, 'lastTransitionTime': "
           "'2020-03-29T01:03:02Z', 'reason': 'PodCompleted'}, {'type': "
           "'Ready', 'status': 'False', 'lastProbeTime': None, "
           "'lastTransitionTime': '2020-03-29T01:03:20Z', 'reason': "
           "'PodCompleted'}, {'type': 'ContainersReady', 'status': 'False', "
           "'lastProbeTime': None, 'lastTransitionTime': "
           "'2020-03-29T01:03:20Z', 'reason': 'PodCompleted'}, {'type': "
           "'PodScheduled', 'status': 'True', 'lastProbeTime': None, "
           "'lastTransitionTime': '2020-03-29T01:03:02Z'}], 'hostIP': "
           "'172.17.0.12', 'podIP': '10.244.1.72', 'podIPs': [{'ip': "
           "'10.244.1.72'}], 'startTime': '2020-03-29T01:03:02Z', "
           "'containerStatuses': [{'name': 'kube-hunter', 'state': "
           "{'terminated': {'exitCode': 0, 'reason': 'Completed', 'startedAt': "
           "'2020-03-29T01:03:06Z', 'finishedAt': '2020-03-29T01:03:19Z', "
           "'containerID': "
           "'containerd://dde45dd0c062e0e12cd3d5b705009e28996a59a2999205c72f39a0145b6f35b4'}}, "
           "'lastState': {}, 'ready': False, 'restartCount': 0, 'image': "
           "'docker.io/aquasec/kube-hunter:latest', 'imageID': "
           "'docker.io/aquasec/kube-hunter@sha256:563f44851d413c7199a0a8a2a13df1e98bee48229e19f4917e6da68e5482df6e', "
           "'containerID': "
           "'containerd://dde45dd0c062e0e12cd3d5b705009e28996a59a2999205c72f39a0145b6f35b4', "
           "'started': False}], 'qosClass': 'BestEffort'}"}
2020-03-29 01:03:20,564 - functest_kubernetes.security.security - DEBUG - delete_namespaced_deployment: {'api_version': 'batch/v1',
 'code': None,
 'details': None,
 'kind': 'Job',
 'message': None,
 'metadata': {'_continue': None,
              'remaining_item_count': None,
              'resource_version': '3623476',
              'self_link': '/apis/batch/v1/namespaces/default/jobs/kube-hunter'},
 'reason': None,
 'status': "{'conditions': [{'type': 'Complete', 'status': 'True', "
           "'lastProbeTime': '2020-03-29T01:03:20Z', 'lastTransitionTime': "
           "'2020-03-29T01:03:20Z'}], 'startTime': '2020-03-29T01:03:02Z', "
           "'completionTime': '2020-03-29T01:03:20Z', 'succeeded': 1}"}
2020-03-29 01:03:20,865 - xtesting.core.testcase - DEBUG - Publishing /var/lib/xtesting/results/functest-kubernetes.log ('text/plain', None)
