mirror of https://git.rancher.io/charts
[dev-v2.11] forward port cis benchmark from dev-v2.10 (#4873)
Nicholas openSUSE Software Engineer
GitHub
parent
74ee11eff6
commit
78f8be7e7d
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,10 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark-crd
|
||||
apiVersion: v1
|
||||
description: Installs the CRDs for rancher-cis-benchmark.
|
||||
name: rancher-cis-benchmark-crd
|
||||
type: application
|
||||
version: 105.0.1+up7.0.1
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
# rancher-cis-benchmark-crd
|
||||
A Rancher chart that installs the CRDs used by rancher-cis-benchmark.
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscans.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScan
|
||||
plural: clusterscans
|
||||
singular: clusterscan
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.lastRunScanProfileName
|
||||
name: ClusterScanProfile
|
||||
type: string
|
||||
- jsonPath: .status.summary.total
|
||||
name: Total
|
||||
type: string
|
||||
- jsonPath: .status.summary.pass
|
||||
name: Pass
|
||||
type: string
|
||||
- jsonPath: .status.summary.fail
|
||||
name: Fail
|
||||
type: string
|
||||
- jsonPath: .status.summary.skip
|
||||
name: Skip
|
||||
type: string
|
||||
- jsonPath: .status.summary.warn
|
||||
name: Warn
|
||||
type: string
|
||||
- jsonPath: .status.summary.notApplicable
|
||||
name: Not Applicable
|
||||
type: string
|
||||
- jsonPath: .status.lastRunTimestamp
|
||||
name: LastRunTimestamp
|
||||
type: string
|
||||
- jsonPath: .spec.scheduledScanConfig.cronSchedule
|
||||
name: CronSchedule
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
scanProfileName:
|
||||
nullable: true
|
||||
type: string
|
||||
scheduledScanConfig:
|
||||
nullable: true
|
||||
properties:
|
||||
cronSchedule:
|
||||
nullable: true
|
||||
type: string
|
||||
retentionCount:
|
||||
type: integer
|
||||
scanAlertRule:
|
||||
nullable: true
|
||||
properties:
|
||||
alertOnComplete:
|
||||
type: boolean
|
||||
alertOnFailure:
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
scoreWarning:
|
||||
enum:
|
||||
- pass
|
||||
- fail
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
NextScanAt:
|
||||
nullable: true
|
||||
type: string
|
||||
ScanAlertingRuleName:
|
||||
nullable: true
|
||||
type: string
|
||||
conditions:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
nullable: true
|
||||
type: string
|
||||
lastUpdateTime:
|
||||
nullable: true
|
||||
type: string
|
||||
message:
|
||||
nullable: true
|
||||
type: string
|
||||
reason:
|
||||
nullable: true
|
||||
type: string
|
||||
status:
|
||||
nullable: true
|
||||
type: string
|
||||
type:
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
display:
|
||||
nullable: true
|
||||
properties:
|
||||
error:
|
||||
type: boolean
|
||||
message:
|
||||
nullable: true
|
||||
type: string
|
||||
state:
|
||||
nullable: true
|
||||
type: string
|
||||
transitioning:
|
||||
type: boolean
|
||||
type: object
|
||||
lastRunScanProfileName:
|
||||
nullable: true
|
||||
type: string
|
||||
lastRunTimestamp:
|
||||
nullable: true
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
summary:
|
||||
nullable: true
|
||||
properties:
|
||||
fail:
|
||||
type: integer
|
||||
notApplicable:
|
||||
type: integer
|
||||
pass:
|
||||
type: integer
|
||||
skip:
|
||||
type: integer
|
||||
total:
|
||||
type: integer
|
||||
warn:
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscanbenchmarks.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScanBenchmark
|
||||
plural: clusterscanbenchmarks
|
||||
singular: clusterscanbenchmark
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.clusterProvider
|
||||
name: ClusterProvider
|
||||
type: string
|
||||
- jsonPath: .spec.minKubernetesVersion
|
||||
name: MinKubernetesVersion
|
||||
type: string
|
||||
- jsonPath: .spec.maxKubernetesVersion
|
||||
name: MaxKubernetesVersion
|
||||
type: string
|
||||
- jsonPath: .spec.customBenchmarkConfigMapName
|
||||
name: customBenchmarkConfigMapName
|
||||
type: string
|
||||
- jsonPath: .spec.customBenchmarkConfigMapNamespace
|
||||
name: customBenchmarkConfigMapNamespace
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
clusterProvider:
|
||||
nullable: true
|
||||
type: string
|
||||
customBenchmarkConfigMapName:
|
||||
nullable: true
|
||||
type: string
|
||||
customBenchmarkConfigMapNamespace:
|
||||
nullable: true
|
||||
type: string
|
||||
maxKubernetesVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
minKubernetesVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscanprofiles.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScanProfile
|
||||
plural: clusterscanprofiles
|
||||
singular: clusterscanprofile
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.benchmarkVersion
|
||||
name: BenchmarkVersion
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
benchmarkVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
skipTests:
|
||||
items:
|
||||
nullable: true
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscanreports.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScanReport
|
||||
plural: clusterscanreports
|
||||
singular: clusterscanreport
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.lastRunTimestamp
|
||||
name: LastRunTimestamp
|
||||
type: string
|
||||
- jsonPath: .spec.benchmarkVersion
|
||||
name: BenchmarkVersion
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
benchmarkVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
lastRunTimestamp:
|
||||
nullable: true
|
||||
type: string
|
||||
reportJSON:
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark-crd
|
||||
apiVersion: v1
|
||||
description: Installs the CRDs for rancher-cis-benchmark.
|
||||
name: rancher-cis-benchmark-crd
|
||||
type: application
|
||||
version: 105.1.0+up7.1.1
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
# rancher-cis-benchmark-crd
|
||||
A Rancher chart that installs the CRDs used by rancher-cis-benchmark.
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscans.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScan
|
||||
plural: clusterscans
|
||||
singular: clusterscan
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.lastRunScanProfileName
|
||||
name: ClusterScanProfile
|
||||
type: string
|
||||
- jsonPath: .status.summary.total
|
||||
name: Total
|
||||
type: string
|
||||
- jsonPath: .status.summary.pass
|
||||
name: Pass
|
||||
type: string
|
||||
- jsonPath: .status.summary.fail
|
||||
name: Fail
|
||||
type: string
|
||||
- jsonPath: .status.summary.skip
|
||||
name: Skip
|
||||
type: string
|
||||
- jsonPath: .status.summary.warn
|
||||
name: Warn
|
||||
type: string
|
||||
- jsonPath: .status.summary.notApplicable
|
||||
name: Not Applicable
|
||||
type: string
|
||||
- jsonPath: .status.lastRunTimestamp
|
||||
name: LastRunTimestamp
|
||||
type: string
|
||||
- jsonPath: .spec.scheduledScanConfig.cronSchedule
|
||||
name: CronSchedule
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
scanProfileName:
|
||||
nullable: true
|
||||
type: string
|
||||
scheduledScanConfig:
|
||||
nullable: true
|
||||
properties:
|
||||
cronSchedule:
|
||||
nullable: true
|
||||
type: string
|
||||
retentionCount:
|
||||
type: integer
|
||||
scanAlertRule:
|
||||
nullable: true
|
||||
properties:
|
||||
alertOnComplete:
|
||||
type: boolean
|
||||
alertOnFailure:
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
scoreWarning:
|
||||
enum:
|
||||
- pass
|
||||
- fail
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
NextScanAt:
|
||||
nullable: true
|
||||
type: string
|
||||
ScanAlertingRuleName:
|
||||
nullable: true
|
||||
type: string
|
||||
conditions:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
nullable: true
|
||||
type: string
|
||||
lastUpdateTime:
|
||||
nullable: true
|
||||
type: string
|
||||
message:
|
||||
nullable: true
|
||||
type: string
|
||||
reason:
|
||||
nullable: true
|
||||
type: string
|
||||
status:
|
||||
nullable: true
|
||||
type: string
|
||||
type:
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
display:
|
||||
nullable: true
|
||||
properties:
|
||||
error:
|
||||
type: boolean
|
||||
message:
|
||||
nullable: true
|
||||
type: string
|
||||
state:
|
||||
nullable: true
|
||||
type: string
|
||||
transitioning:
|
||||
type: boolean
|
||||
type: object
|
||||
lastRunScanProfileName:
|
||||
nullable: true
|
||||
type: string
|
||||
lastRunTimestamp:
|
||||
nullable: true
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
summary:
|
||||
nullable: true
|
||||
properties:
|
||||
fail:
|
||||
type: integer
|
||||
notApplicable:
|
||||
type: integer
|
||||
pass:
|
||||
type: integer
|
||||
skip:
|
||||
type: integer
|
||||
total:
|
||||
type: integer
|
||||
warn:
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscanbenchmarks.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScanBenchmark
|
||||
plural: clusterscanbenchmarks
|
||||
singular: clusterscanbenchmark
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.clusterProvider
|
||||
name: ClusterProvider
|
||||
type: string
|
||||
- jsonPath: .spec.minKubernetesVersion
|
||||
name: MinKubernetesVersion
|
||||
type: string
|
||||
- jsonPath: .spec.maxKubernetesVersion
|
||||
name: MaxKubernetesVersion
|
||||
type: string
|
||||
- jsonPath: .spec.customBenchmarkConfigMapName
|
||||
name: customBenchmarkConfigMapName
|
||||
type: string
|
||||
- jsonPath: .spec.customBenchmarkConfigMapNamespace
|
||||
name: customBenchmarkConfigMapNamespace
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
clusterProvider:
|
||||
nullable: true
|
||||
type: string
|
||||
customBenchmarkConfigMapName:
|
||||
nullable: true
|
||||
type: string
|
||||
customBenchmarkConfigMapNamespace:
|
||||
nullable: true
|
||||
type: string
|
||||
maxKubernetesVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
minKubernetesVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscanprofiles.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScanProfile
|
||||
plural: clusterscanprofiles
|
||||
singular: clusterscanprofile
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.benchmarkVersion
|
||||
name: BenchmarkVersion
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
benchmarkVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
skipTests:
|
||||
items:
|
||||
nullable: true
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterscanreports.cis.cattle.io
|
||||
spec:
|
||||
group: cis.cattle.io
|
||||
names:
|
||||
kind: ClusterScanReport
|
||||
plural: clusterscanreports
|
||||
singular: clusterscanreport
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.lastRunTimestamp
|
||||
name: LastRunTimestamp
|
||||
type: string
|
||||
- jsonPath: .spec.benchmarkVersion
|
||||
name: BenchmarkVersion
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
benchmarkVersion:
|
||||
nullable: true
|
||||
type: string
|
||||
lastRunTimestamp:
|
||||
nullable: true
|
||||
type: string
|
||||
reportJSON:
|
||||
nullable: true
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
annotations:
|
||||
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/display-name: CIS Benchmark
|
||||
catalog.cattle.io/kube-version: '>= 1.28.0-0 < 1.32.0-0'
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1
|
||||
catalog.cattle.io/rancher-version: '>= 2.10.0-0 < 2.11.0-0'
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark
|
||||
catalog.cattle.io/type: cluster-tool
|
||||
catalog.cattle.io/ui-component: rancher-cis-benchmark
|
||||
apiVersion: v1
|
||||
appVersion: v7.0.1
|
||||
description: The cis-operator enables running CIS benchmark security scans on a kubernetes
|
||||
cluster
|
||||
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
|
||||
keywords:
|
||||
- security
|
||||
name: rancher-cis-benchmark
|
||||
version: 105.0.1+up7.0.1
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
# Rancher CIS Benchmark Chart
|
||||
|
||||
The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded.
|
||||
|
||||
# Installation
|
||||
|
||||
```
|
||||
helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system
|
||||
```
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
# Rancher CIS Benchmarks
|
||||
|
||||
This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
|
||||
For more information on how to use the feature, refer to our [docs](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides).
|
||||
|
||||
This chart installs the following components:
|
||||
|
||||
- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded.
|
||||
- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed.
|
||||
- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans.
|
||||
- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources.
|
||||
- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish.
|
||||
- If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts.
|
||||
- Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart.
|
||||
|
||||
## CIS Kubernetes Benchmark support
|
||||
|
||||
| Source | Kubernetes distribution | scan profile | Kubernetes versions |
|
||||
|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------|
|
||||
| CIS | any | [cis-1.8](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.8) | v1.26+ |
|
||||
| CIS | rke | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+ |
|
||||
| CIS | rke | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+ |
|
||||
| CIS | rke2 | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-permissive)| rke2-v1.26+ |
|
||||
| CIS | rke2 | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+ |
|
||||
| CIS | k3s | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+ |
|
||||
| CIS | k3s | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+ |
|
||||
| CIS | eks | eks-1.2.0 | eks |
|
||||
| CIS | aks | aks-1.0 | aks |
|
||||
| CIS | gke | gke-1.2.0 | gke |
|
||||
| CIS | gke | gke-1.6.0 | gke-1.29+ |
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{{/* Ensure namespace is set the same everywhere */}}
|
||||
{{- define "cis.namespace" -}}
|
||||
{{- .Release.Namespace | default "cis-operator-system" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "system_default_registry" -}}
|
||||
{{- if .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- else -}}
|
||||
{{- "" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Windows cluster will add default taint for linux nodes,
|
||||
add below linux tolerations to workloads could be scheduled to those linux nodes
|
||||
*/}}
|
||||
{{- define "linux-node-tolerations" -}}
|
||||
- key: "cattle.io/os"
|
||||
value: "linux"
|
||||
effect: "NoSchedule"
|
||||
operator: "Equal"
|
||||
{{- end -}}
|
||||
|
||||
{{- define "linux-node-selector" -}}
|
||||
kubernetes.io/os: linux
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{{- if .Values.alerts.enabled -}}
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: rancher-cis-pod-monitor
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
podMetricsEndpoints:
|
||||
- port: cismetrics
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: aks-1.0
|
||||
spec:
|
||||
clusterProvider: aks
|
||||
minKubernetesVersion: "1.15.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: cis-1.8
|
||||
spec:
|
||||
clusterProvider: ""
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: eks-1.2.0
|
||||
spec:
|
||||
clusterProvider: eks
|
||||
minKubernetesVersion: "1.15.0"
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: gke-1.2.0
|
||||
spec:
|
||||
clusterProvider: gke
|
||||
minKubernetesVersion: "1.15.0"
|
||||
maxKubernetesVersion: "1.28.x"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: gke-1.6.0
|
||||
spec:
|
||||
clusterProvider: gke
|
||||
minKubernetesVersion: "1.29.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: k3s-cis-1.8-hardened
|
||||
spec:
|
||||
clusterProvider: k3s
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: k3s-cis-1.8-permissive
|
||||
spec:
|
||||
clusterProvider: k3s
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke-cis-1.8-hardened
|
||||
spec:
|
||||
clusterProvider: rke
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke-cis-1.8-permissive
|
||||
spec:
|
||||
clusterProvider: rke
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke2-cis-1.8-hardened
|
||||
spec:
|
||||
clusterProvider: rke2
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke2-cis-1.8-permissive
|
||||
spec:
|
||||
clusterProvider: rke2
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cis-admin
|
||||
rules:
|
||||
- apiGroups:
|
||||
- cis.cattle.io
|
||||
resources:
|
||||
- clusterscanbenchmarks
|
||||
- clusterscanprofiles
|
||||
- clusterscans
|
||||
- clusterscanreports
|
||||
verbs: ["create", "update", "delete", "patch","get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- catalog.cattle.io
|
||||
resources: ["apps"]
|
||||
resourceNames: ["rancher-cis-benchmark"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cis-view
|
||||
rules:
|
||||
- apiGroups:
|
||||
- cis.cattle.io
|
||||
resources:
|
||||
- clusterscanbenchmarks
|
||||
- clusterscanprofiles
|
||||
- clusterscans
|
||||
- clusterscanreports
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- catalog.cattle.io
|
||||
resources: ["apps"]
|
||||
resourceNames: ["rancher-cis-benchmark"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: default-clusterscanprofiles
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
data:
|
||||
# Default ClusterScanProfiles per cluster provider type
|
||||
rke: |-
|
||||
<1.21.0: rke-profile-permissive-1.20
|
||||
>=1.21.0: rke-profile-permissive-1.8
|
||||
rke2: |-
|
||||
<1.21.0: rke2-cis-1.20-profile-permissive
|
||||
>=1.21.0: rke2-cis-1.8-profile-permissive
|
||||
eks: "eks-profile"
|
||||
gke: "gke-profile"
|
||||
aks: "aks-profile"
|
||||
k3s: "k3s-cis-1.8-profile-permissive"
|
||||
default: "cis-1.8-profile"
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cis-operator
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
labels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
spec:
|
||||
serviceAccountName: cis-operator-serviceaccount
|
||||
containers:
|
||||
- name: cis-operator
|
||||
image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}'
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: cismetrics
|
||||
containerPort: {{ .Values.alerts.metricsPort }}
|
||||
env:
|
||||
- name: SECURITY_SCAN_IMAGE
|
||||
value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }}
|
||||
- name: SECURITY_SCAN_IMAGE_TAG
|
||||
value: {{ .Values.image.securityScan.tag }}
|
||||
- name: SONOBUOY_IMAGE
|
||||
value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }}
|
||||
- name: SONOBUOY_IMAGE_TAG
|
||||
value: {{ .Values.image.sonobuoy.tag }}
|
||||
- name: CIS_ALERTS_METRICS_PORT
|
||||
value: '{{ .Values.alerts.metricsPort }}'
|
||||
- name: CIS_ALERTS_SEVERITY
|
||||
value: {{ .Values.alerts.severity }}
|
||||
- name: CIS_ALERTS_ENABLED
|
||||
value: {{ .Values.alerts.enabled | default "false" | quote }}
|
||||
- name: CLUSTER_NAME
|
||||
value: '{{ .Values.global.cattle.clusterName }}'
|
||||
- name: CIS_OPERATOR_DEBUG
|
||||
value: '{{ .Values.image.cisoperator.debug }}'
|
||||
{{- if .Values.securityScanJob.overrideTolerations }}
|
||||
- name: SECURITY_SCAN_JOB_TOLERATIONS
|
||||
value: '{{ .Values.securityScanJob.tolerations | toJson }}'
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
{{- if .Values.tolerations }}
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-allow-all
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
spec:
|
||||
podSelector: {}
|
||||
ingress:
|
||||
- {}
|
||||
egress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: patch-sa
|
||||
annotations:
|
||||
"helm.sh/hook": post-install, post-upgrade
|
||||
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: cis-operator-serviceaccount
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
{{- if .Values.tolerations }}
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: sa
|
||||
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"]
|
||||
args: ["-n", {{ template "cis.namespace" . }}]
|
||||
|
||||
backoffLimit: 1
|
||||
|
|
@ -0,0 +1,209 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-operator-clusterrole
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cis.cattle.io"
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
- "services"
|
||||
- "configmaps"
|
||||
- "nodes"
|
||||
- "serviceaccounts"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "create"
|
||||
- "update"
|
||||
- "watch"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "rbac.authorization.k8s.io"
|
||||
resources:
|
||||
- "rolebindings"
|
||||
- "clusterrolebindings"
|
||||
- "clusterroles"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- "jobs"
|
||||
verbs:
|
||||
- "list"
|
||||
- "create"
|
||||
- "patch"
|
||||
- "update"
|
||||
- "watch"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-scan-ns
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces"
|
||||
- "nodes"
|
||||
- "pods"
|
||||
- "serviceaccounts"
|
||||
- "services"
|
||||
- "replicationcontrollers"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- "rbac.authorization.k8s.io"
|
||||
resources:
|
||||
- "rolebindings"
|
||||
- "clusterrolebindings"
|
||||
- "clusterroles"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- "jobs"
|
||||
- "cronjobs"
|
||||
verbs:
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "apps"
|
||||
resources:
|
||||
- "daemonsets"
|
||||
- "deployments"
|
||||
- "replicasets"
|
||||
- "statefulsets"
|
||||
verbs:
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "autoscaling"
|
||||
resources:
|
||||
- "horizontalpodautoscalers"
|
||||
verbs:
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "networking.k8s.io"
|
||||
resources:
|
||||
- "networkpolicies"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cis-operator-role
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "services"
|
||||
verbs:
|
||||
- "watch"
|
||||
- "list"
|
||||
- "get"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- "jobs"
|
||||
verbs:
|
||||
- "watch"
|
||||
- "list"
|
||||
- "get"
|
||||
- "delete"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
- "pods"
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- "apps"
|
||||
resources:
|
||||
- "daemonsets"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- prometheusrules
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-operator-clusterrolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cis-operator-clusterrole
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cis-operator-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cis-scan-ns
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cis-scan-ns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cis-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-operator-rolebinding
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cis-operator-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cis-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
- kind: ServiceAccount
|
||||
name: cis-operator-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: cis-1.8-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: cis-1.8
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: k3s-cis-1.8-profile-hardened
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: k3s-cis-1.8-hardened
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: k3s-cis-1.8-profile-permissive
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: k3s-cis-1.8-permissive
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke-profile-hardened-1.8
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke-cis-1.8-hardened
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke-profile-permissive-1.8
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke-cis-1.8-permissive
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke2-cis-1.8-profile-hardened
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke2-cis-1.8-hardened
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke2-cis-1.8-profile-permissive
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke2-cis-1.8-permissive
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: aks-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: aks-1.0
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: eks-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: eks-1.2.0
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: gke-profile-1.6.0
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: gke-1.6.0
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: gke-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: gke-1.2.0
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
name: cis-operator-serviceaccount
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-serviceaccount
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}}
|
||||
# {{- $found := dict -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}}
|
||||
# {{- range .Capabilities.APIVersions -}}
|
||||
# {{- if hasKey $found (toString .) -}}
|
||||
# {{- set $found (toString .) true -}}
|
||||
# {{- end -}}
|
||||
# {{- end -}}
|
||||
# {{- range $_, $exists := $found -}}
|
||||
# {{- if (eq $exists false) -}}
|
||||
# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}}
|
||||
# {{- end -}}
|
||||
# {{- end -}}
|
||||
#{{- end -}}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
# Default values for rancher-cis-benchmark.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
image:
|
||||
cisoperator:
|
||||
repository: rancher/cis-operator
|
||||
tag: v1.3.1
|
||||
securityScan:
|
||||
repository: rancher/security-scan
|
||||
tag: v0.5.1
|
||||
sonobuoy:
|
||||
repository: rancher/mirrored-sonobuoy-sonobuoy
|
||||
tag: v0.57.2
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
|
||||
## List of node taints to tolerate (requires Kubernetes >= 1.6)
|
||||
tolerations: []
|
||||
|
||||
securityScanJob:
|
||||
overrideTolerations: false
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
global:
|
||||
cattle:
|
||||
systemDefaultRegistry: ""
|
||||
clusterName: ""
|
||||
kubectl:
|
||||
repository: rancher/kubectl
|
||||
tag: v1.30.7
|
||||
|
||||
alerts:
|
||||
enabled: false
|
||||
severity: warning
|
||||
metricsPort: 8080
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
annotations:
|
||||
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/display-name: CIS Benchmark
|
||||
catalog.cattle.io/kube-version: '>= 1.28.0-0 < 1.32.0-0'
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1
|
||||
catalog.cattle.io/rancher-version: '>= 2.10.0-0 < 2.11.0-0'
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark
|
||||
catalog.cattle.io/type: cluster-tool
|
||||
catalog.cattle.io/ui-component: rancher-cis-benchmark
|
||||
apiVersion: v1
|
||||
appVersion: v7.1.1
|
||||
description: The cis-operator enables running CIS benchmark security scans on a kubernetes
|
||||
cluster
|
||||
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
|
||||
keywords:
|
||||
- security
|
||||
name: rancher-cis-benchmark
|
||||
version: 105.1.0+up7.1.1
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
# Rancher CIS Benchmark Chart
|
||||
|
||||
The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded.
|
||||
|
||||
# Installation
|
||||
|
||||
```
|
||||
helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system
|
||||
```
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
# Rancher CIS Benchmarks
|
||||
|
||||
This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
|
||||
For more information on how to use the feature, refer to our [docs](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides).
|
||||
|
||||
This chart installs the following components:
|
||||
|
||||
- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded.
|
||||
- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed.
|
||||
- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans.
|
||||
- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources.
|
||||
- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish.
|
||||
- If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts.
|
||||
- Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart.
|
||||
|
||||
## CIS Kubernetes Benchmark support
|
||||
|
||||
| Source | Kubernetes distribution | scan profile | Kubernetes versions |
|
||||
|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------|
|
||||
| CIS | any | [cis-1.8](https://github.com/aquasecurity/kube-bench/tree/main/cfg/cis-1.8) | v1.26+ |
|
||||
| CIS | rke | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+ |
|
||||
| CIS | rke | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+ |
|
||||
| CIS | rke2 | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.8-permissive) | rke2-v1.26+ |
|
||||
| CIS | rke2 | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+ |
|
||||
| CIS | k3s | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+ |
|
||||
| CIS | k3s | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+ |
|
||||
| CIS | eks | [eks-1.2.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/eks-1.2.0) | eks |
|
||||
| CIS | aks | [aks-1.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/aks-1.0) | aks |
|
||||
| CIS | gke | [gke-1.2.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/gke-1.2.0) | gke-1.20 |
|
||||
| CIS | gke | [gke-1.6.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/gke-1.6.0) | gke-1.29+ |
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{{/* Ensure namespace is set the same everywhere */}}
|
||||
{{- define "cis.namespace" -}}
|
||||
{{- .Release.Namespace | default "cis-operator-system" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "system_default_registry" -}}
|
||||
{{- if .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- else -}}
|
||||
{{- "" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Windows cluster will add default taint for linux nodes,
|
||||
add below linux tolerations to workloads could be scheduled to those linux nodes
|
||||
*/}}
|
||||
{{- define "linux-node-tolerations" -}}
|
||||
- key: "cattle.io/os"
|
||||
value: "linux"
|
||||
effect: "NoSchedule"
|
||||
operator: "Equal"
|
||||
{{- end -}}
|
||||
|
||||
{{- define "linux-node-selector" -}}
|
||||
kubernetes.io/os: linux
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{{- if .Values.alerts.enabled -}}
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: rancher-cis-pod-monitor
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
podMetricsEndpoints:
|
||||
- port: cismetrics
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: aks-1.0
|
||||
spec:
|
||||
clusterProvider: aks
|
||||
minKubernetesVersion: "1.15.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: cis-1.8
|
||||
spec:
|
||||
clusterProvider: ""
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: eks-1.2.0
|
||||
spec:
|
||||
clusterProvider: eks
|
||||
minKubernetesVersion: "1.15.0"
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: gke-1.2.0
|
||||
spec:
|
||||
clusterProvider: gke
|
||||
minKubernetesVersion: "1.15.0"
|
||||
maxKubernetesVersion: "1.28.x"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: gke-1.6.0
|
||||
spec:
|
||||
clusterProvider: gke
|
||||
minKubernetesVersion: "1.29.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: k3s-cis-1.8-hardened
|
||||
spec:
|
||||
clusterProvider: k3s
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: k3s-cis-1.8-permissive
|
||||
spec:
|
||||
clusterProvider: k3s
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke-cis-1.8-hardened
|
||||
spec:
|
||||
clusterProvider: rke
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke-cis-1.8-permissive
|
||||
spec:
|
||||
clusterProvider: rke
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke2-cis-1.8-hardened
|
||||
spec:
|
||||
clusterProvider: rke2
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
name: rke2-cis-1.8-permissive
|
||||
spec:
|
||||
clusterProvider: rke2
|
||||
minKubernetesVersion: "1.26.0"
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cis-admin
|
||||
rules:
|
||||
- apiGroups:
|
||||
- cis.cattle.io
|
||||
resources:
|
||||
- clusterscanbenchmarks
|
||||
- clusterscanprofiles
|
||||
- clusterscans
|
||||
- clusterscanreports
|
||||
verbs: ["create", "update", "delete", "patch","get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- catalog.cattle.io
|
||||
resources: ["apps"]
|
||||
resourceNames: ["rancher-cis-benchmark"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cis-view
|
||||
rules:
|
||||
- apiGroups:
|
||||
- cis.cattle.io
|
||||
resources:
|
||||
- clusterscanbenchmarks
|
||||
- clusterscanprofiles
|
||||
- clusterscans
|
||||
- clusterscanreports
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- catalog.cattle.io
|
||||
resources: ["apps"]
|
||||
resourceNames: ["rancher-cis-benchmark"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: default-clusterscanprofiles
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
data:
|
||||
# Default ClusterScanProfiles per cluster provider type
|
||||
rke: |-
|
||||
<1.21.0: rke-profile-permissive-1.20
|
||||
>=1.21.0: rke-profile-permissive-1.8
|
||||
rke2: |-
|
||||
<1.21.0: rke2-cis-1.20-profile-permissive
|
||||
>=1.21.0: rke2-cis-1.8-profile-permissive
|
||||
eks: "eks-profile"
|
||||
gke: "gke-profile-1.6.0"
|
||||
aks: "aks-profile"
|
||||
k3s: "k3s-cis-1.8-profile-permissive"
|
||||
default: "cis-1.8-profile"
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cis-operator
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
labels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
cis.cattle.io/operator: cis-operator
|
||||
spec:
|
||||
serviceAccountName: cis-operator-serviceaccount
|
||||
containers:
|
||||
- name: cis-operator
|
||||
image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}'
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: cismetrics
|
||||
containerPort: {{ .Values.alerts.metricsPort }}
|
||||
env:
|
||||
- name: SECURITY_SCAN_IMAGE
|
||||
value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }}
|
||||
- name: SECURITY_SCAN_IMAGE_TAG
|
||||
value: {{ .Values.image.securityScan.tag }}
|
||||
- name: SONOBUOY_IMAGE
|
||||
value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }}
|
||||
- name: SONOBUOY_IMAGE_TAG
|
||||
value: {{ .Values.image.sonobuoy.tag }}
|
||||
- name: CIS_ALERTS_METRICS_PORT
|
||||
value: '{{ .Values.alerts.metricsPort }}'
|
||||
- name: CIS_ALERTS_SEVERITY
|
||||
value: {{ .Values.alerts.severity }}
|
||||
- name: CIS_ALERTS_ENABLED
|
||||
value: {{ .Values.alerts.enabled | default "false" | quote }}
|
||||
- name: CLUSTER_NAME
|
||||
value: '{{ .Values.global.cattle.clusterName }}'
|
||||
- name: CIS_OPERATOR_DEBUG
|
||||
value: '{{ .Values.image.cisoperator.debug }}'
|
||||
{{- if .Values.securityScanJob.overrideTolerations }}
|
||||
- name: SECURITY_SCAN_JOB_TOLERATIONS
|
||||
value: '{{ .Values.securityScanJob.tolerations | toJson }}'
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
{{- if .Values.tolerations }}
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-allow-all
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
spec:
|
||||
podSelector: {}
|
||||
ingress:
|
||||
- {}
|
||||
egress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: patch-sa
|
||||
annotations:
|
||||
"helm.sh/hook": post-install, post-upgrade
|
||||
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: cis-operator-serviceaccount
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
{{- if .Values.tolerations }}
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: sa
|
||||
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"]
|
||||
args: ["-n", {{ template "cis.namespace" . }}]
|
||||
|
||||
backoffLimit: 1
|
||||
|
|
@ -0,0 +1,209 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-operator-clusterrole
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cis.cattle.io"
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
- "services"
|
||||
- "configmaps"
|
||||
- "nodes"
|
||||
- "serviceaccounts"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "create"
|
||||
- "update"
|
||||
- "watch"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "rbac.authorization.k8s.io"
|
||||
resources:
|
||||
- "rolebindings"
|
||||
- "clusterrolebindings"
|
||||
- "clusterroles"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- "jobs"
|
||||
verbs:
|
||||
- "list"
|
||||
- "create"
|
||||
- "patch"
|
||||
- "update"
|
||||
- "watch"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-scan-ns
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces"
|
||||
- "nodes"
|
||||
- "pods"
|
||||
- "serviceaccounts"
|
||||
- "services"
|
||||
- "replicationcontrollers"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- "rbac.authorization.k8s.io"
|
||||
resources:
|
||||
- "rolebindings"
|
||||
- "clusterrolebindings"
|
||||
- "clusterroles"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- "jobs"
|
||||
- "cronjobs"
|
||||
verbs:
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "apps"
|
||||
resources:
|
||||
- "daemonsets"
|
||||
- "deployments"
|
||||
- "replicasets"
|
||||
- "statefulsets"
|
||||
verbs:
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "autoscaling"
|
||||
resources:
|
||||
- "horizontalpodautoscalers"
|
||||
verbs:
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "networking.k8s.io"
|
||||
resources:
|
||||
- "networkpolicies"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cis-operator-role
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "services"
|
||||
verbs:
|
||||
- "watch"
|
||||
- "list"
|
||||
- "get"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- "jobs"
|
||||
verbs:
|
||||
- "watch"
|
||||
- "list"
|
||||
- "get"
|
||||
- "delete"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
- "pods"
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- "apps"
|
||||
resources:
|
||||
- "daemonsets"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- prometheusrules
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-operator-clusterrolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cis-operator-clusterrole
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cis-operator-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cis-scan-ns
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cis-scan-ns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cis-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-operator-rolebinding
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cis-operator-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cis-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
- kind: ServiceAccount
|
||||
name: cis-operator-serviceaccount
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: cis-1.8-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: cis-1.8
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: k3s-cis-1.8-profile-hardened
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: k3s-cis-1.8-hardened
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: k3s-cis-1.8-profile-permissive
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: k3s-cis-1.8-permissive
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke-profile-hardened-1.8
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke-cis-1.8-hardened
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke-profile-permissive-1.8
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke-cis-1.8-permissive
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke2-cis-1.8-profile-hardened
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke2-cis-1.8-hardened
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: rke2-cis-1.8-profile-permissive
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: rke2-cis-1.8-permissive
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: aks-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: aks-1.0
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: eks-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: eks-1.2.0
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: gke-profile-1.6.0
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: gke-1.6.0
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: cis.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
name: gke-profile
|
||||
annotations:
|
||||
clusterscanprofile.cis.cattle.io/builtin: "true"
|
||||
spec:
|
||||
benchmarkVersion: gke-1.2.0
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
name: cis-operator-serviceaccount
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
namespace: {{ template "cis.namespace" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: rancher-cis-benchmark
|
||||
app.kubernetes.io/instance: release-name
|
||||
name: cis-serviceaccount
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}}
|
||||
# {{- $found := dict -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}}
|
||||
# {{- range .Capabilities.APIVersions -}}
|
||||
# {{- if hasKey $found (toString .) -}}
|
||||
# {{- set $found (toString .) true -}}
|
||||
# {{- end -}}
|
||||
# {{- end -}}
|
||||
# {{- range $_, $exists := $found -}}
|
||||
# {{- if (eq $exists false) -}}
|
||||
# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}}
|
||||
# {{- end -}}
|
||||
# {{- end -}}
|
||||
#{{- end -}}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
# Default values for rancher-cis-benchmark.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
image:
|
||||
cisoperator:
|
||||
repository: rancher/cis-operator
|
||||
tag: v1.3.4
|
||||
securityScan:
|
||||
repository: rancher/security-scan
|
||||
tag: v0.5.2
|
||||
sonobuoy:
|
||||
repository: rancher/mirrored-sonobuoy-sonobuoy
|
||||
tag: v0.57.2
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
|
||||
## List of node taints to tolerate (requires Kubernetes >= 1.6)
|
||||
tolerations: []
|
||||
|
||||
securityScanJob:
|
||||
overrideTolerations: false
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
global:
|
||||
cattle:
|
||||
systemDefaultRegistry: ""
|
||||
clusterName: ""
|
||||
kubectl:
|
||||
repository: rancher/kubectl
|
||||
tag: v1.30.7
|
||||
|
||||
alerts:
|
||||
enabled: false
|
||||
severity: warning
|
||||
metricsPort: 8080
|
||||
80
index.yaml
80
index.yaml
|
|
@ -10144,6 +10144,58 @@ entries:
|
|||
- assets/rancher-backup-crd/rancher-backup-crd-1.0.200.tgz
|
||||
version: 1.0.200
|
||||
rancher-cis-benchmark:
|
||||
- annotations:
|
||||
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/display-name: CIS Benchmark
|
||||
catalog.cattle.io/kube-version: '>= 1.28.0-0 < 1.32.0-0'
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1
|
||||
catalog.cattle.io/rancher-version: '>= 2.10.0-0 < 2.11.0-0'
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark
|
||||
catalog.cattle.io/type: cluster-tool
|
||||
catalog.cattle.io/ui-component: rancher-cis-benchmark
|
||||
apiVersion: v1
|
||||
appVersion: v7.1.1
|
||||
created: "2024-12-13T14:44:10.430580151-03:00"
|
||||
description: The cis-operator enables running CIS benchmark security scans on
|
||||
a kubernetes cluster
|
||||
digest: fa1589febd004a733b2de6400d8c6c7a01a7062859cd40a83685cc94f4de36eb
|
||||
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
|
||||
keywords:
|
||||
- security
|
||||
name: rancher-cis-benchmark
|
||||
urls:
|
||||
- assets/rancher-cis-benchmark/rancher-cis-benchmark-105.1.0+up7.1.1.tgz
|
||||
version: 105.1.0+up7.1.1
|
||||
- annotations:
|
||||
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/display-name: CIS Benchmark
|
||||
catalog.cattle.io/kube-version: '>= 1.28.0-0 < 1.32.0-0'
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1
|
||||
catalog.cattle.io/rancher-version: '>= 2.10.0-0 < 2.11.0-0'
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark
|
||||
catalog.cattle.io/type: cluster-tool
|
||||
catalog.cattle.io/ui-component: rancher-cis-benchmark
|
||||
apiVersion: v1
|
||||
appVersion: v7.0.1
|
||||
created: "2024-12-13T14:42:18.033949544-03:00"
|
||||
description: The cis-operator enables running CIS benchmark security scans on
|
||||
a kubernetes cluster
|
||||
digest: bb6f150c7b5ef815299dc1420e9cbf9a4b35ac8eda0b72d78b897456d6fddceb
|
||||
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
|
||||
keywords:
|
||||
- security
|
||||
name: rancher-cis-benchmark
|
||||
urls:
|
||||
- assets/rancher-cis-benchmark/rancher-cis-benchmark-105.0.1+up7.0.1.tgz
|
||||
version: 105.0.1+up7.0.1
|
||||
- annotations:
|
||||
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
|
|
@ -10870,6 +10922,34 @@ entries:
|
|||
- assets/rancher-cis-benchmark/rancher-cis-benchmark-2.0.0.tgz
|
||||
version: 2.0.0
|
||||
rancher-cis-benchmark-crd:
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark-crd
|
||||
apiVersion: v1
|
||||
created: "2024-12-13T14:44:42.664321914-03:00"
|
||||
description: Installs the CRDs for rancher-cis-benchmark.
|
||||
digest: f6efdb6242fe5327ed152037ac04ce2654606df83e8479e3d0db36776835fad8
|
||||
name: rancher-cis-benchmark-crd
|
||||
type: application
|
||||
urls:
|
||||
- assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-105.1.0+up7.1.1.tgz
|
||||
version: 105.1.0+up7.1.1
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/namespace: cis-operator-system
|
||||
catalog.cattle.io/release-name: rancher-cis-benchmark-crd
|
||||
apiVersion: v1
|
||||
created: "2024-12-13T14:43:36.122056829-03:00"
|
||||
description: Installs the CRDs for rancher-cis-benchmark.
|
||||
digest: 8e68bf5483baae513c358dfeb1fe28f2f636b3d4943171e35a0ae2939e8b8223
|
||||
name: rancher-cis-benchmark-crd
|
||||
type: application
|
||||
urls:
|
||||
- assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-105.0.1+up7.0.1.tgz
|
||||
version: 105.0.1+up7.0.1
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,17 @@
|
|||
#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}}
|
||||
# {{- $found := dict -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}}
|
||||
# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}}
|
||||
# {{- range .Capabilities.APIVersions -}}
|
||||
# {{- if hasKey $found (toString .) -}}
|
||||
# {{- set $found (toString .) true -}}
|
||||
# {{- end -}}
|
||||
# {{- end -}}
|
||||
# {{- range $_, $exists := $found -}}
|
||||
# {{- if (eq $exists false) -}}
|
||||
# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}}
|
||||
# {{- end -}}
|
||||
# {{- end -}}
|
||||
#{{- end -}}
|
||||
|
|
@ -21,8 +21,12 @@ neuvector-monitor:
|
|||
- 105.0.0+up2.8.3
|
||||
rancher-cis-benchmark:
|
||||
- 105.0.0+up7.0.0
|
||||
- 105.0.1+up7.0.1
|
||||
- 105.1.0+up7.1.1
|
||||
rancher-cis-benchmark-crd:
|
||||
- 105.0.0+up7.0.0
|
||||
- 105.0.1+up7.0.1
|
||||
- 105.1.0+up7.1.1
|
||||
rancher-csp-adapter:
|
||||
- 105.0.0+up5.0.1
|
||||
rancher-logging:
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@
|
|||
set -e
|
||||
|
||||
CHARTS_BUILD_SCRIPTS_REPO=https://github.com/rancher/charts-build-scripts.git
|
||||
CHARTS_BUILD_SCRIPT_VERSION="${CHARTS_BUILD_SCRIPT_VERSION:-v1.2.0}"
|
||||
CHARTS_BUILD_SCRIPT_VERSION="${CHARTS_BUILD_SCRIPT_VERSION:-v1.3.2}"
|
||||
|
|
|
|||
Loading…
Reference in New Issue