Project: KICS (Provisioning / Security & Compliance)
File: ca2fba76-c1a7-4afd-be67-5249f861cb0e.md

title: Tiller (Helm v2) Is Deployed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ca2fba76-c1a7-4afd-be67-5249f861cb0e Query name: Tiller (Helm v2) Is Deployed Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Check if Tiller is deployed.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="3 103 8 200 175" resource "kubernetes_pod" "positive1" { metadata { name = "tiller-deploy" } spec { container = [ { image = "tiller-image" name = "example22" env = { name = "environment" value = "test" } port = { container_port = 8080 } liveness_probe = { http_get = { path = "/nginx_status" port = 80 http_header = { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } , { image = "nginx:1.7.9" name = "example22222" resources = { requests = { cpu = "250m" memory = "50Mi" } } env = { name = "environment" value = "test" } port = { container_port = 8080 } liveness_probe = { http_get = { path = "/nginx_status" port = 80 http_header = { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } ] dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_pod" "positive2" { metadata { name = "terraform-example" } spec { container { image = "tiller-image" name = "example" resources { limits { cpu = "0.5" memory = "512Mi" } } env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_deployment" "example" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { app = "helm" } } spec { volume = [ { host_path = { path = "/var/run/docker.sock" type = "Directory" } } , { host_path = { path =

type = "Directory" } } ] container { image = "tiller-image" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "negative1" { metadata { name = "terraform-example" } spec { container = [ { image = "nginx:1.7.9" name = "example22" resources = { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } env = { name = "environment" value = "test" } port = { container_port = 8080 } liveness_probe = { http_get = { path = "/nginx_status" port = 80 http_header = { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } , { image = "nginx:1.7.9" name = "example22222" resources = { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } env = { name = "environment" value = "test" } port = { container_port = 8080 } liveness_probe = { http_get = { path = "/nginx_status" port = 80 http_header = { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } ] dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_deployment" "example2" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { test = "MyExampleApp" } } spec { volume = [ { host_path = { path = "/data" type = "Directory" } } , { host_path = { path = "/data" type = "Directory" } } ] container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } ```