Merge pull request #2169 from galal-hussein/fix_charts_psp_hardened

Fix charts psp hardened

charts/rancher-cis-benchmark-crd/3.0.0-rc8/Chart.yaml

@@ -7,4 +7,4 @@ apiVersion: v1
 description: Installs the CRDs for rancher-cis-benchmark.
 name: rancher-cis-benchmark-crd
 type: application
-version: 3.0.0-rc7
+version: 3.0.0-rc8

charts/rancher-cis-benchmark/3.0.0-rc8/Chart.yaml

@@ -19,4 +19,4 @@ icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
 keywords:
 - security
 name: rancher-cis-benchmark
-version: 3.0.0-rc7
+version: 3.0.0-rc8

charts/rancher-cis-benchmark/3.0.0-rc8/templates/rbac.yaml

@@ -46,11 +46,20 @@ metadata:
     app.kubernetes.io/instance: release-name
   name: cis-scan-ns
 rules:
+- apiGroups:
+  - "*"
+  resources:
+  - "podsecuritypolicies"
+  verbs: 
+  - "get"
+  - "list"
+  - "watch"
 - apiGroups:
   - ""
   resources:
   - "namespaces"
   - "nodes"
+  - "pods"
   verbs:
   - "get"
   - "list"

charts/rancher-cis-benchmark/3.0.0-rc8/values.yaml

@@ -8,7 +8,7 @@ image:
     tag: v1.0.10-rc2
   securityScan:
     repository: rancher/security-scan
-    tag: v0.2.9-rc4
+    tag: v0.2.9-rc5
   sonobuoy:
     repository: rancher/mirrored-sonobuoy-sonobuoy
     tag: v0.56.7

index.yaml

@@ -3436,17 +3436,17 @@ entries:
       catalog.cattle.io/ui-component: rancher-cis-benchmark
     apiVersion: v1
     appVersion: v3.0.0
-    created: "2022-10-14T21:06:42.77523739+02:00"
+    created: "2022-10-18T23:00:17.259715427+02:00"
     description: The cis-operator enables running CIS benchmark security scans on
       a kubernetes cluster
-    digest: e254d98add7979243b248ab7e5ceefe55bb32f1c8d0973d424373fd438915e04
+    digest: 22d1116483cc01cbceba2f3733b120261af5279ed2b15d4a28d869a17a838720
     icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
     keywords:
     - security
     name: rancher-cis-benchmark
     urls:
-    - assets/rancher-cis-benchmark/rancher-cis-benchmark-3.0.0-rc7.tgz
-    version: 3.0.0-rc7
+    - assets/rancher-cis-benchmark/rancher-cis-benchmark-3.0.0-rc8.tgz
+    version: 3.0.0-rc8
   - annotations:
       catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
       catalog.cattle.io/certified: rancher
@@ -3767,14 +3767,14 @@ entries:
       catalog.cattle.io/namespace: cis-operator-system
       catalog.cattle.io/release-name: rancher-cis-benchmark-crd
     apiVersion: v1
-    created: "2022-10-14T21:06:42.777200088+02:00"
+    created: "2022-10-18T23:00:17.261637441+02:00"
     description: Installs the CRDs for rancher-cis-benchmark.
-    digest: acbfae01ff2e431687bff0edd2545d3af16ef779e7668f81736db01481de9028
+    digest: 25225ec34aac875d216fe72dd81788384dad7f6f2479c3ecbb814b8b7f1af5b3
     name: rancher-cis-benchmark-crd
     type: application
     urls:
-    - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-3.0.0-rc7.tgz
-    version: 3.0.0-rc7
+    - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-3.0.0-rc8.tgz
+    version: 3.0.0-rc8
   - annotations:
       catalog.cattle.io/certified: rancher
       catalog.cattle.io/hidden: "true"

packages/rancher-cis-benchmark/charts/templates/rbac.yaml

@@ -46,11 +46,20 @@ metadata:
     app.kubernetes.io/instance: release-name
   name: cis-scan-ns
 rules:
+- apiGroups:
+  - "*"
+  resources:
+  - "podsecuritypolicies"
+  verbs: 
+  - "get"
+  - "list"
+  - "watch"
 - apiGroups:
   - ""
   resources:
   - "namespaces"
   - "nodes"
+  - "pods"
   verbs:
   - "get"
   - "list"

packages/rancher-cis-benchmark/charts/values.yaml

@@ -8,7 +8,7 @@ image:
     tag: v1.0.10-rc2
   securityScan:
     repository: rancher/security-scan
-    tag: v0.2.9-rc4
+    tag: v0.2.9-rc5
   sonobuoy:
     repository: rancher/mirrored-sonobuoy-sonobuoy
     tag: v0.56.7

packages/rancher-cis-benchmark/package.yaml

@@ -1,5 +1,5 @@
 url: local
-version: 3.0.0-rc7
+version: 3.0.0-rc8
 additionalCharts:
   - workingDir: charts-crd
     crdOptions:

release.yaml

@@ -19,9 +19,9 @@ rancher-aks-operator-crd:
 rancher-alerting-drivers:
   - 101.0.0
 rancher-cis-benchmark:
-  - 3.0.0-rc7
+  - 3.0.0-rc8
 rancher-cis-benchmark-crd:
-  - 3.0.0-rc7
+  - 3.0.0-rc8
 rancher-csp-adapter:
   - 2.0.0+up2.0.0-rc1
 rancher-backup: