From 9d2a020eaedf9a2fb77deecd68fba8b10313cf97 Mon Sep 17 00:00:00 2001 From: Prachi Damle Date: Tue, 16 Aug 2022 17:17:26 -0700 Subject: [PATCH] make charts --- .../rancher-cis-benchmark-crd-2.1.0.tgz | Bin 0 -> 1463 bytes .../rancher-cis-benchmark-2.1.0.tgz | Bin 0 -> 6159 bytes .../2.1.0/Chart.yaml | 10 ++ .../rancher-cis-benchmark-crd/2.1.0/README.md | 2 + .../2.1.0/templates/clusterscan.yaml | 148 ++++++++++++++++++ .../2.1.0/templates/clusterscanbenchmark.yaml | 54 +++++++ .../2.1.0/templates/clusterscanprofile.yaml | 36 +++++ .../2.1.0/templates/clusterscanreport.yaml | 39 +++++ charts/rancher-cis-benchmark/2.1.0/Chart.yaml | 22 +++ charts/rancher-cis-benchmark/2.1.0/README.md | 9 ++ .../rancher-cis-benchmark/2.1.0/app-readme.md | 15 ++ .../2.1.0/templates/_helpers.tpl | 27 ++++ .../2.1.0/templates/alertingrule.yaml | 14 ++ .../2.1.0/templates/benchmark-aks-1.0.yaml | 8 + .../2.1.0/templates/benchmark-cis-1.20.yaml | 8 + .../2.1.0/templates/benchmark-cis-1.23.yaml | 8 + .../2.1.0/templates/benchmark-cis-1.5.yaml | 8 + .../2.1.0/templates/benchmark-cis-1.6.yaml | 8 + .../2.1.0/templates/benchmark-eks-1.0.1.yaml | 8 + .../2.1.0/templates/benchmark-gke-1.0.yaml | 8 + .../benchmark-k3s-cis-1.20-hardened.yaml | 8 + .../benchmark-k3s-cis-1.20-permissive.yaml | 8 + .../benchmark-k3s-cis-1.23-hardened.yaml | 8 + .../benchmark-k3s-cis-1.23-permissive.yaml | 8 + .../benchmark-k3s-cis-1.6-hardened.yaml | 8 + .../benchmark-k3s-cis-1.6-permissive.yaml | 8 + .../benchmark-rke-cis-1.20-hardened.yaml | 8 + .../benchmark-rke-cis-1.20-permissive.yaml | 8 + .../benchmark-rke-cis-1.23-hardened.yaml | 8 + .../benchmark-rke-cis-1.23-permissive.yaml | 8 + .../benchmark-rke-cis-1.5-hardened.yaml | 8 + .../benchmark-rke-cis-1.5-permissive.yaml | 8 + .../benchmark-rke-cis-1.6-hardened.yaml | 8 + .../benchmark-rke-cis-1.6-permissive.yaml | 8 + .../benchmark-rke2-cis-1.20-hardened.yaml | 8 + .../benchmark-rke2-cis-1.20-permissive.yaml | 8 + .../benchmark-rke2-cis-1.23-hardened.yaml | 8 + .../benchmark-rke2-cis-1.23-permissive.yaml | 8 + .../benchmark-rke2-cis-1.5-hardened.yaml | 8 + .../benchmark-rke2-cis-1.5-permissive.yaml | 8 + .../benchmark-rke2-cis-1.6-hardened.yaml | 8 + .../benchmark-rke2-cis-1.6-permissive.yaml | 8 + .../2.1.0/templates/cis-roles.yaml | 49 ++++++ .../2.1.0/templates/configmap.yaml | 18 +++ .../2.1.0/templates/deployment.yaml | 55 +++++++ .../templates/network_policy_allow_all.yaml | 15 ++ .../patch_default_serviceaccount.yaml | 29 ++++ .../2.1.0/templates/rbac.yaml | 43 +++++ .../2.1.0/templates/scanprofile-cis-1.20.yaml | 9 ++ .../2.1.0/templates/scanprofile-cis-1.23.yaml | 9 ++ .../2.1.0/templates/scanprofile-cis-1.5.yml | 9 ++ .../2.1.0/templates/scanprofile-cis-1.6.yaml | 9 ++ .../scanprofile-k3s-cis-1.20-hardened.yml | 9 ++ .../scanprofile-k3s-cis-1.20-permissive.yml | 9 ++ .../scanprofile-k3s-cis-1.23-hardened.yml | 9 ++ .../scanprofile-k3s-cis-1.23-permissive.yml | 9 ++ .../scanprofile-k3s-cis-1.6-hardened.yml | 9 ++ .../scanprofile-k3s-cis-1.6-permissive.yml | 9 ++ .../scanprofile-rke-1.20-hardened.yaml | 9 ++ .../scanprofile-rke-1.20-permissive.yaml | 9 ++ .../scanprofile-rke-1.23-hardened.yaml | 9 ++ .../scanprofile-rke-1.23-permissive.yaml | 9 ++ .../scanprofile-rke-1.5-hardened.yml | 9 ++ .../scanprofile-rke-1.5-permissive.yml | 9 ++ .../scanprofile-rke-1.6-hardened.yaml | 9 ++ .../scanprofile-rke-1.6-permissive.yaml | 9 ++ .../scanprofile-rke2-cis-1.20-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.20-permissive.yml | 9 ++ .../scanprofile-rke2-cis-1.23-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.23-permissive.yml | 9 ++ .../scanprofile-rke2-cis-1.5-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.5-permissive.yml | 9 ++ .../scanprofile-rke2-cis-1.6-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.6-permissive.yml | 9 ++ .../2.1.0/templates/scanprofileaks.yml | 9 ++ .../2.1.0/templates/scanprofileeks.yml | 9 ++ .../2.1.0/templates/scanprofilegke.yml | 9 ++ .../2.1.0/templates/serviceaccount.yaml | 14 ++ .../2.1.0/templates/validate-install-crd.yaml | 17 ++ .../rancher-cis-benchmark/2.1.0/values.yaml | 49 ++++++ index.yaml | 40 +++++ 81 files changed, 1198 insertions(+) create mode 100644 assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0.tgz create mode 100644 assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0.tgz create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0/Chart.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0/README.md create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscan.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanbenchmark.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanprofile.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanreport.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/Chart.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/README.md create mode 100644 charts/rancher-cis-benchmark/2.1.0/app-readme.md create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/_helpers.tpl create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/alertingrule.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-aks-1.0.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.20.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.23.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.5.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.6.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-eks-1.0.1.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-gke-1.0.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/cis-roles.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/configmap.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/deployment.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/network_policy_allow_all.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/patch_default_serviceaccount.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/rbac.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.20.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.23.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.5.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.6.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofileaks.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofileeks.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/scanprofilegke.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/serviceaccount.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/templates/validate-install-crd.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0/values.yaml diff --git a/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0.tgz b/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..faa8d6ced4d1fe75e4c0ed2b99ee883530f28cc3 GIT binary patch literal 1463 zcmV;o1xWfIiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI>(bK*7-&NIJ4bA85V6CfSla@@6ZZ7-K0>GgS$H=v6xd8BoE zOsD_7BijkKu`vciu5;`QgCu_|+24LEt*t@wCF(vGrawo?mm%oKKG*)+=@K+KD+q&& z1I=|^cRU;>zpm?+f8Ei*z3_&Et1I`?8;!;nt~YkCh8N5|)bTDB8v=dd9_*{Uxc`ZP zl!}0al4jCli~~WS77hoZ03D&;a?~Uq1o{(}aiwzDQusc~34232#y6EiB!p-p;5cEH zZ7MB08+_uPT!72|*4U5-ZQ_&QkwQnDdgcPc7|w2+Hh2PO_f z&?|=&K~TWG&$YCIiolox((SsT70?5S;*@?_H?#sWk0L4n-K`s10sReH7J&X*H?#th zimp?&p9jUqd83GJbnS$laphiwXb8gMivOtYYyggsJBBaOj|22A!=_3;h=s$ol6P5q zk&K%i8!k*d*IBq{%(t;(moQ=f{F@HpOAO(;Q$;ARZ$Eyyyel*_7HOO9Nvv^_i!&`) zTlKiqQ6aF(-HgdN2<(H%MRDFX7MF+KxNoiD>nCn4{}ihF8{r#PU`->Tw3;@-|yv;re!1#?iw;bv=}<ONoPU4W9Z%BH?pB|UBRmTqwemR zYeFt8-MWryu4J0SD_AH9!%A{CQP(Q>y#{F#WUJA2eA^*T8bdnu_h;k-;qiTiXpG$j z9o30OFiIZRM-{uf_K^%YqKBCD5ZspwJIngrV zXyEjs1C_GR8kfK28CRbsx|GNA9<)nrHBXONzoJB)R7p0`w{1nTy?4hnwTX4VZBgM2 zupfj?_IvKh9!15&+2zXQq`2Ru_V~2Vm9>?kz8b|K^kwU+h2b*Z#PA+VwTKe!r> zOZC6Y!Ek)8|DD2)UH^L_OoxTQch8tfcSS{T?euj^gAsBko7SyXPr`qZ%tA%5)VD*a zClvDcc#c{kp~;?K0r^w?fL-9>TLXOkfF0m@!laj{n3h~VL9|gZ-C^K??vnRWJNwL! z{;sQKCDL_zuHJHgPURMazXBD~s*yMuStorTrCc1X9fmin(TQmwxVYtsMmXjIn!@!UsbG literal 0 HcmV?d00001 diff --git a/assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0.tgz b/assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..979367403a66f127f995df52f47fa46ce7e8dac2 GIT binary patch literal 6159 zcmYkAcR1Dm|NoDSGP8=Z_ej}$95T`%BFZ{M32{P3MK3cePBNln?}i<+I++Ik=oQvrV1y@ruwQG+x zRqrURbD(*_LJ{?_3Wux6e%Z20T?t+b)`9ZxnYiqG5s67tCxmuencLuVW1~EiK{#n_CIU zQfQc5;{U7l)BOW2GG!JWSc+R^{T#k8qXdsKl@vhP$(n3) zUGMo0MFyPRk8Z16Tw;qZ%3_^cMqpx+rq(}sm$E{`aN^O@NH%Ik&dpSZKceEqNlW&w zXtCEf=0cXl9N0wiT`Mj$0Jc{rl|AY?A5p{^~dz)YKobi8M1nN z(t=XDSza?=2+@3?al0fj=8fuV#iv)O0TOTX9uQy@O)XV|9p8l-##?{>0OW+6Q4lc8 z*wU#OcZ}XQw<9BAW?|f0C;Y%lHvEe4=FT7V_+UnYrX^D-?+7d);`Lv8BjITd1J`s} zHnAv++TP=R+%Xa;I_az!8cXRJlgPndy2QPFrMrz3E`8@7iJJ~`$~Wq^o4$zOa4R?! zHx&q`!(POz3%U@ai{A2=OZeTG^cg3cU!8k_68$_a?_wT3dn{DS><#%A*SOFpp2X++ zy<&6u{O#mYhA&))QWwR=IO(pk|J@?+XP$gTKPumHeyVm-?4&iB%|44cEMiBD;jV^>(Dpqeec$@B*pOA>K7|WfbsOjUP64@ChKV&L= zTa;AKdAUssZuF*ah`DoG3faFP{xxO!HnLbb8oXVUFF%uU&LM-Q$oO-~4H}`y&y4XF zGxqV3^Wh~7?aGcPWi8rqwWKc^mm`-F#nZNqW;^5)8P1?&3O&yxT({#(l zwiX&WIxIw8DW1xoPzmCyJsRWH_ct3Kv1)t9B*8dlI_=#|&6iGkUNAPX6&|I?D1P=C zE?+^yk-cp`S^1JgnH0`9|M{jPv01+B(=+;?-avVMx+(h(d%?>JrmM}zV&*YU2O%94 zgu|nua&jf@!9h84F22`P*v%zbZHv>D^?WbCfxk~Kp@yY#tu_aJ{_FX2o4Bilq@q?h99D z2>GpF@nU3)>dxOSyT;#t?JH?XI@6GZFx!5W`RLJ0M+Zj!c_?TEtOhpGY6Aqb+C-~) z=8IAJJD2`+i#MeOBcX$~q8bz!AGMfF$Vv~?_ykUy`Fv@GBia!*!%e+MAmg#3af70OP~`2jpF#*b@=V?`A=s3OJq)R2PCNu1a8B<^v7e z4ph|(c5?ne=QYlQTE!X!ZC*AF>D5CWAf^1lmx4hq0k1X>Lhg%X@>*{Hw;FJ@eT$U4 z=T^@!do6A=IUh<@)93*^i3dXk&Yxc`K~yt}*`{4ePUf1s0>FWR_lOXB|3U77rr1GC=)Q!|zJoKZl4Ol298M*aJJ}xJh7V zApowsP|6v~&SG~E{Z-ur!2A{1J+!0X`NfFK@@yX%CMPie9Nxr&)}&C-aN4>Dxbnl^ z(+Hj^K17g7z<6o{RMMwyfeZqmU2CX?MhnHkxdz}!q#*x|@c)eAZQ%ep4!kbjB;j*~ zNe$@m_m?y&wtD|729V&!he%cZQRxnFb_^VMJH72Q=WwDFVjM zLIR+6VILTRjZzn&YF1eB8YUEAPFrJvm^w_S=UFqwR+ajd9}$V84s~-IaPQ+h!#pkH z0loVFWInD_aCX!XP}8u@svVFm0d-Mx;KGAdBp%f6Ky`T+DY@dLhO>Egsq;|Ve-eqn z%it~v?nnEjW00!X;FLKF7a|H0JLRVJY~;w;4+RZTug{o@CL+sc=-(wc9@^`DVz zMx$#Lv->Y+AYZR-j39G;1Q?&U+XMqEIk^aCNRI8$n^efDY1Zg?7z&Z%2z$FjTGNHR+Lh8c?s zr+S#(^PeyQU6#2Ztn^z_R3uG(pK!- z2K&TCaYoZD;q!3!c#G$vOE2&bHhCYJOKL=wdU;=aO^4)`-tW4xAM z_azR5;5(chV^X=D?9=OYPAyH1ts$WSWXj_Hz$kImR^G=4M-C=Gv)>*uT=>0gSc9y1 z*7QAe$2pFxniFqv&>cSS)Y?j#+Z+ArDlSSz+R#JYfbV&llHr|_BsPqR!`$EpC$O+c z9^G4?`l_zoq>bZG2}7B_T&e2J9Fz4ZzgfRXqq2b)upqfBomBF;t#v5Cdsk11K6~R` z)C*#8ima#O?YnHt@X zIAy-2@1@X}Ic;C>@TQ~dtHdwIrjQ8Q=nJe0_0RZ9t@sWYNhvFVE_U=ztSl(4@49GC} z+nU>34Z07AL^;UDD7`gh&+3AV=Zx5e8d9{k?x49+8a3(sElqM_{uV+EV*LK$NsSLq zuS&aT{-$ai_$ya~JHU%ry`e2H2(;#SaBUpzF4X zIYTeW?=|VT#6qr|rb!Hvmb{le=rT|nxxfF~gx1-p<%|#tF`{|X@b4`y!le!oBJ%X% zS9$Uoeml_oa~g~{{+&DkD{XOV{=b*5UFJPoeipwtf|5eh2C>%ZUgwPoU#>E64l^n! zyt|h5Ol@l9`??q(pTNA?IX-{B<*o-$zsl6tlk_vMPy9~sOtrirNhY4fHVJ#I>R7Zg zdaWqQpWcV6g>>L)-6rlcaAcO9g({sW2XX*T+eN?y zy{0d0>mcEDz}u0ACHQFM$PNZ^j!aA^=SI&{fgp!XwhhXj-o`Lw<$y>#0=$X@Y{hCUB>-VgINoMc)*a}p@4kGNZ9}nNJAB1$_ z@P;iaS7ZS%yw+$5jbEc)ATu;U-GWYk_Nnfu*fkH~Io6?}Nw8q~2ArA#pLN08)7FCk zTLpBz0LoaCaxy*xh^>Kr!pYEP(0tmu1GFtO9hC&}=-JO(1XERh_zj#22_#5f-!+9|mWL+7a@ zp5MoqvpTOsBHX{BhJNO-;{;4ADD`*wMXYg8~eJ zj5i+|1fvmF+tj)ljxwehFkM-ajB)0kh1+1kzyYL{?Y~N;KC5jZuLXEFDM%YN6N1oX z+Juy}w?lKyQmer}sqzUm@ar~2=-eXcTr&cmX9>*R29(Ndce@SozlJ0{vK$0G@g`Cb z=X?C&uEcJG2J|)fzQ&X*ThGi7c&U7cSXO(BB^JA}5c4n=1c~SAS!M{nSPP#2dqBCt zKMR$P|4L=zOprgog=q7`4^H&gd{}ozRTWL<;%*(Rx=m9fiVcL%J8wKk2;=E3InY6Gi$|+Ua66VFyXfZX! z+%9=ygPHRc2Wwe@^vu_wN=~wrzsxdki4jHMwa2p|Zj5C_4dbVwlt;k5(A4YlN3OJ# zn0_45*5Ms|CZ{cTQ(ZRg2RXgR;oPt?N%iWTcl9=$;TRL^ypsc~yW%d6}b8c-WQr2pRqR9>VGV-`(#+Ci#Gn104dE;qX(Nua}0wqK^tTP$N>7IzG# zz$)r|b($Gsv%VM9J#2+N=& z5?ExW6Y{Mfr&Yg1KCv;(_K3%jUOg^s>0Gu5^jPhtY-)#%SM{w=f@aFTjTs+p4E>5t z?1reOfG^F?PfcEbMfD^7RkREuY@YqH3O%2gW%3tgb`6t!{HE!b#?1n6`!@QZ;G_&1z*wo*Yi_~(05U-u4*MIrk$=1 zJC_k=UcL+oGJ7RLESsN+VV>NeCf96xg`&Ch z3uZ?hPI{)mQCN$qtlshPSC`sH1oTI_Z)IJNeU{~G=QHB7qj{7n&63_UBsRkuFSYP= z6w!3qRnMM1o!wyQ|qaCHGOe8g%i7&BNt`MnqgZJ4!0zx z=xa^u{*ysBcgs(YvHG9MvuKJPzum0;)(4VRZ_(y_PO~?Ek)f=pr1q^uZ;vy>N8i~Z zbz?ZwW(aKZ&R@?6L*K-Y<3kP$pI;f)=eR9WVkWq|ly*BgdkXdkcNy1d`BTkg{_un234o7;U zex~el<9s#+5h&mJ{7j8Q-g9(O{|*RIx$?M{u@|gk?Ym6LRaJ*q TwlFl*yMLfz?XC+mrGfn)su0;z literal 0 HcmV?d00001 diff --git a/charts/rancher-cis-benchmark-crd/2.1.0/Chart.yaml b/charts/rancher-cis-benchmark-crd/2.1.0/Chart.yaml new file mode 100644 index 000000000..8e98af6da --- /dev/null +++ b/charts/rancher-cis-benchmark-crd/2.1.0/Chart.yaml @@ -0,0 +1,10 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/release-name: rancher-cis-benchmark-crd +apiVersion: v1 +description: Installs the CRDs for rancher-cis-benchmark. +name: rancher-cis-benchmark-crd +type: application +version: 2.1.0 diff --git a/charts/rancher-cis-benchmark-crd/2.1.0/README.md b/charts/rancher-cis-benchmark-crd/2.1.0/README.md new file mode 100644 index 000000000..f6d9ef621 --- /dev/null +++ b/charts/rancher-cis-benchmark-crd/2.1.0/README.md @@ -0,0 +1,2 @@ +# rancher-cis-benchmark-crd +A Rancher chart that installs the CRDs used by rancher-cis-benchmark. diff --git a/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscan.yaml b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscan.yaml new file mode 100644 index 000000000..3cbb0ffcd --- /dev/null +++ b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscan.yaml @@ -0,0 +1,148 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterscans.cis.cattle.io +spec: + group: cis.cattle.io + names: + kind: ClusterScan + plural: clusterscans + scope: Cluster + versions: + - name: v1 + served: true + storage: true + additionalPrinterColumns: + - jsonPath: .status.lastRunScanProfileName + name: ClusterScanProfile + type: string + - jsonPath: .status.summary.total + name: Total + type: string + - jsonPath: .status.summary.pass + name: Pass + type: string + - jsonPath: .status.summary.fail + name: Fail + type: string + - jsonPath: .status.summary.skip + name: Skip + type: string + - jsonPath: .status.summary.warn + name: Warn + type: string + - jsonPath: .status.summary.notApplicable + name: Not Applicable + type: string + - jsonPath: .status.lastRunTimestamp + name: LastRunTimestamp + type: string + - jsonPath: .spec.scheduledScanConfig.cronSchedule + name: CronSchedule + type: string + subresources: + status: {} + schema: + openAPIV3Schema: + properties: + spec: + properties: + scanProfileName: + nullable: true + type: string + scheduledScanConfig: + nullable: true + properties: + cronSchedule: + nullable: true + type: string + retentionCount: + type: integer + scanAlertRule: + nullable: true + properties: + alertOnComplete: + type: boolean + alertOnFailure: + type: boolean + type: object + type: object + scoreWarning: + enum: + - pass + - fail + nullable: true + type: string + type: object + status: + properties: + NextScanAt: + nullable: true + type: string + ScanAlertingRuleName: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + display: + nullable: true + properties: + error: + type: boolean + message: + nullable: true + type: string + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + lastRunScanProfileName: + nullable: true + type: string + lastRunTimestamp: + nullable: true + type: string + observedGeneration: + type: integer + summary: + nullable: true + properties: + fail: + type: integer + notApplicable: + type: integer + pass: + type: integer + skip: + type: integer + total: + type: integer + warn: + type: integer + type: object + type: object + type: object diff --git a/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanbenchmark.yaml b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanbenchmark.yaml new file mode 100644 index 000000000..fd291f8c3 --- /dev/null +++ b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanbenchmark.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterscanbenchmarks.cis.cattle.io +spec: + group: cis.cattle.io + names: + kind: ClusterScanBenchmark + plural: clusterscanbenchmarks + scope: Cluster + versions: + - name: v1 + served: true + storage: true + additionalPrinterColumns: + - jsonPath: .spec.clusterProvider + name: ClusterProvider + type: string + - jsonPath: .spec.minKubernetesVersion + name: MinKubernetesVersion + type: string + - jsonPath: .spec.maxKubernetesVersion + name: MaxKubernetesVersion + type: string + - jsonPath: .spec.customBenchmarkConfigMapName + name: customBenchmarkConfigMapName + type: string + - jsonPath: .spec.customBenchmarkConfigMapNamespace + name: customBenchmarkConfigMapNamespace + type: string + subresources: + status: {} + schema: + openAPIV3Schema: + properties: + spec: + properties: + clusterProvider: + nullable: true + type: string + customBenchmarkConfigMapName: + nullable: true + type: string + customBenchmarkConfigMapNamespace: + nullable: true + type: string + maxKubernetesVersion: + nullable: true + type: string + minKubernetesVersion: + nullable: true + type: string + type: object + type: object diff --git a/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanprofile.yaml b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanprofile.yaml new file mode 100644 index 000000000..1e75501b7 --- /dev/null +++ b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanprofile.yaml @@ -0,0 +1,36 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterscanprofiles.cis.cattle.io +spec: + group: cis.cattle.io + names: + kind: ClusterScanProfile + plural: clusterscanprofiles + scope: Cluster + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + properties: + spec: + properties: + benchmarkVersion: + nullable: true + type: string + skipTests: + items: + nullable: true + type: string + nullable: true + type: array + type: object + type: object + additionalPrinterColumns: + - jsonPath: .spec.benchmarkVersion + name: BenchmarkVersion + type: string diff --git a/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanreport.yaml b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanreport.yaml new file mode 100644 index 000000000..6e8c0b7de --- /dev/null +++ b/charts/rancher-cis-benchmark-crd/2.1.0/templates/clusterscanreport.yaml @@ -0,0 +1,39 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterscanreports.cis.cattle.io +spec: + group: cis.cattle.io + names: + kind: ClusterScanReport + plural: clusterscanreports + scope: Cluster + versions: + - name: v1 + served: true + storage: true + additionalPrinterColumns: + - jsonPath: .spec.lastRunTimestamp + name: LastRunTimestamp + type: string + - jsonPath: .spec.benchmarkVersion + name: BenchmarkVersion + type: string + subresources: + status: {} + schema: + openAPIV3Schema: + properties: + spec: + properties: + benchmarkVersion: + nullable: true + type: string + lastRunTimestamp: + nullable: true + type: string + reportJSON: + nullable: true + type: string + type: object + type: object \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/Chart.yaml b/charts/rancher-cis-benchmark/2.1.0/Chart.yaml new file mode 100644 index 000000000..fa5ff3366 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/Chart.yaml @@ -0,0 +1,22 @@ +annotations: + catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: CIS Benchmark + catalog.cattle.io/kube-version: '>= 1.21.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 + catalog.cattle.io/rancher-version: '>= 2.6.0-0 < 2.7.0-0' + catalog.cattle.io/release-name: rancher-cis-benchmark + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: rancher-cis-benchmark +apiVersion: v1 +appVersion: v2.1.0 +description: The cis-operator enables running CIS benchmark security scans on a kubernetes + cluster +icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg +keywords: +- security +name: rancher-cis-benchmark +version: 2.1.0 diff --git a/charts/rancher-cis-benchmark/2.1.0/README.md b/charts/rancher-cis-benchmark/2.1.0/README.md new file mode 100644 index 000000000..50beab58b --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/README.md @@ -0,0 +1,9 @@ +# Rancher CIS Benchmark Chart + +The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded. + +# Installation + +``` +helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system +``` diff --git a/charts/rancher-cis-benchmark/2.1.0/app-readme.md b/charts/rancher-cis-benchmark/2.1.0/app-readme.md new file mode 100644 index 000000000..5e495d605 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/app-readme.md @@ -0,0 +1,15 @@ +# Rancher CIS Benchmarks + +This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/). + +For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/). + +This chart installs the following components: + +- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded. +- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed. +- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans. +- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources. +- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish. + - If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts. + - Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart. diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/_helpers.tpl b/charts/rancher-cis-benchmark/2.1.0/templates/_helpers.tpl new file mode 100644 index 000000000..b7bb00042 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/_helpers.tpl @@ -0,0 +1,27 @@ +{{/* Ensure namespace is set the same everywhere */}} +{{- define "cis.namespace" -}} + {{- .Release.Namespace | default "cis-operator-system" -}} +{{- end -}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/alertingrule.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/alertingrule.yaml new file mode 100644 index 000000000..1787c88a0 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/alertingrule.yaml @@ -0,0 +1,14 @@ +{{- if .Values.alerts.enabled -}} +--- +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: rancher-cis-pod-monitor + namespace: {{ template "cis.namespace" . }} +spec: + selector: + matchLabels: + cis.cattle.io/operator: cis-operator + podMetricsEndpoints: + - port: cismetrics +{{- end }} diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-aks-1.0.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-aks-1.0.yaml new file mode 100644 index 000000000..1ac866253 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-aks-1.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: aks-1.0 +spec: + clusterProvider: aks + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.20.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.20.yaml new file mode 100644 index 000000000..898976581 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.20.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.20 +spec: + clusterProvider: "" + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.23.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.23.yaml new file mode 100644 index 000000000..a4c6d1ff2 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.23.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.23 +spec: + clusterProvider: "" + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.5.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.5.yaml new file mode 100644 index 000000000..39e8b834a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.5.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.5 +spec: + clusterProvider: "" + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.6.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.6.yaml new file mode 100644 index 000000000..93ba064f4 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-cis-1.6.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.6 +spec: + clusterProvider: "" + minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-eks-1.0.1.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-eks-1.0.1.yaml new file mode 100644 index 000000000..d1ba9d295 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-eks-1.0.1.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: eks-1.0.1 +spec: + clusterProvider: eks + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-gke-1.0.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-gke-1.0.yaml new file mode 100644 index 000000000..72122e8c5 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-gke-1.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: gke-1.0 +spec: + clusterProvider: gke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-hardened.yaml new file mode 100644 index 000000000..872bb9b3b --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.20-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-permissive.yaml new file mode 100644 index 000000000..58ec00f23 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.20-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.20-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-hardened.yaml new file mode 100644 index 000000000..bd6ce6188 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.23-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-permissive.yaml new file mode 100644 index 000000000..dd6dee3bb --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.23-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.23-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-hardened.yaml new file mode 100644 index 000000000..3ca9b6009 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.6-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-permissive.yaml new file mode 100644 index 000000000..6d4253c6e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-k3s-cis-1.6-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.6-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-hardened.yaml new file mode 100644 index 000000000..0555922ad --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.20-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-permissive.yaml new file mode 100644 index 000000000..d09e9e1ed --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.20-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.20-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-hardened.yaml new file mode 100644 index 000000000..bc6ad77a6 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.23-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-permissive.yaml new file mode 100644 index 000000000..f63b45590 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.23-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.23-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-hardened.yaml new file mode 100644 index 000000000..b5627f966 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.5-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-permissive.yaml new file mode 100644 index 000000000..95f80c0f0 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.5-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.5-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-hardened.yaml new file mode 100644 index 000000000..d75de8154 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.6-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-permissive.yaml new file mode 100644 index 000000000..52428f4a7 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke-cis-1.6-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.6-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-hardened.yaml new file mode 100644 index 000000000..95375fbea --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.20-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-permissive.yaml new file mode 100644 index 000000000..51da408b9 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.20-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.20-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-hardened.yaml new file mode 100644 index 000000000..1e2cb2a3a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.23-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-permissive.yaml new file mode 100644 index 000000000..eef970c0e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.23-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.23-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-hardened.yaml new file mode 100644 index 000000000..3d83e9bd8 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.5-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.18.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-permissive.yaml new file mode 100644 index 000000000..f66aa8f6e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.5-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.5-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.18.0" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-hardened.yaml new file mode 100644 index 000000000..3593bf371 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.6-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-permissive.yaml new file mode 100644 index 000000000..522f846ae --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/benchmark-rke2-cis-1.6-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.6-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/cis-roles.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/cis-roles.yaml new file mode 100644 index 000000000..23c93dc65 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/cis-roles.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cis-admin +rules: + - apiGroups: + - cis.cattle.io + resources: + - clusterscanbenchmarks + - clusterscanprofiles + - clusterscans + - clusterscanreports + verbs: ["create", "update", "delete", "patch","get", "watch", "list"] + - apiGroups: + - catalog.cattle.io + resources: ["apps"] + resourceNames: ["rancher-cis-benchmark"] + verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - configmaps + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cis-view +rules: + - apiGroups: + - cis.cattle.io + resources: + - clusterscanbenchmarks + - clusterscanprofiles + - clusterscans + - clusterscanreports + verbs: ["get", "watch", "list"] + - apiGroups: + - catalog.cattle.io + resources: ["apps"] + resourceNames: ["rancher-cis-benchmark"] + verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - configmaps + verbs: ["get", "watch", "list"] diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/configmap.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/configmap.yaml new file mode 100644 index 000000000..1a9cd1809 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/configmap.yaml @@ -0,0 +1,18 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: default-clusterscanprofiles + namespace: {{ template "cis.namespace" . }} +data: + # Default ClusterScanProfiles per cluster provider type + rke: |- + <1.21.0: rke-profile-permissive-1.20 + >=1.21.0: rke-profile-permissive-1.23 + rke2: |- + <1.21.0: rke2-cis-1.20-profile-permissive + >=1.21.0: rke2-cis-1.23-profile-permissive + eks: "eks-profile" + gke: "gke-profile" + aks: "aks-profile" + k3s: "k3s-cis-1.23-profile-permissive" + default: "cis-1.23-profile" diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/deployment.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/deployment.yaml new file mode 100644 index 000000000..ab0bb3e24 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/deployment.yaml @@ -0,0 +1,55 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cis-operator + namespace: {{ template "cis.namespace" . }} + labels: + cis.cattle.io/operator: cis-operator +spec: + selector: + matchLabels: + cis.cattle.io/operator: cis-operator + template: + metadata: + labels: + cis.cattle.io/operator: cis-operator + spec: + serviceAccountName: cis-operator-serviceaccount + containers: + - name: cis-operator + image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}' + imagePullPolicy: Always + ports: + - name: cismetrics + containerPort: {{ .Values.alerts.metricsPort }} + env: + - name: SECURITY_SCAN_IMAGE + value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }} + - name: SECURITY_SCAN_IMAGE_TAG + value: {{ .Values.image.securityScan.tag }} + - name: SONOBUOY_IMAGE + value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }} + - name: SONOBUOY_IMAGE_TAG + value: {{ .Values.image.sonobuoy.tag }} + - name: CIS_ALERTS_METRICS_PORT + value: '{{ .Values.alerts.metricsPort }}' + - name: CIS_ALERTS_SEVERITY + value: {{ .Values.alerts.severity }} + - name: CIS_ALERTS_ENABLED + value: {{ .Values.alerts.enabled | default "false" | quote }} + - name: CLUSTER_NAME + value: '{{ .Values.global.cattle.clusterName }}' + resources: + {{- toYaml .Values.resources | nindent 12 }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/network_policy_allow_all.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/network_policy_allow_all.yaml new file mode 100644 index 000000000..6ed5d645e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/network_policy_allow_all.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ template "cis.namespace" . }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/patch_default_serviceaccount.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/patch_default_serviceaccount.yaml new file mode 100644 index 000000000..e78a6bd08 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/patch_default_serviceaccount.yaml @@ -0,0 +1,29 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: patch-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + spec: + serviceAccountName: cis-operator-serviceaccount + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + restartPolicy: Never + containers: + - name: sa + image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", {{ template "cis.namespace" . }}] + + backoffLimit: 1 diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/rbac.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/rbac.yaml new file mode 100644 index 000000000..4ff88ea5f --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/rbac.yaml @@ -0,0 +1,43 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-role +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cis-operator-role +subjects: +- kind: ServiceAccount + name: cis-serviceaccount + namespace: {{ template "cis.namespace" . }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cis-operator-installer +subjects: +- kind: ServiceAccount + name: cis-operator-serviceaccount + namespace: {{ template "cis.namespace" . }} +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.20.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.20.yaml new file mode 100644 index 000000000..05263ce7d --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.20.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.20-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.20 diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.23.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.23.yaml new file mode 100644 index 000000000..c59d8f51f --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.23.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.23-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.23 diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.5.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.5.yml new file mode 100644 index 000000000..d69ae9dd5 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.5.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.5-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.5 diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.6.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.6.yaml new file mode 100644 index 000000000..8a8d8bf88 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-cis-1.6.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.6-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.6 diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-hardened.yml new file mode 100644 index 000000000..a0b6cb6f6 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.20-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-permissive.yml new file mode 100644 index 000000000..89885548d --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.20-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.20-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-hardened.yml new file mode 100644 index 000000000..724412d3a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.23-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-permissive.yml new file mode 100644 index 000000000..9f9213de1 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.23-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.23-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-hardened.yml new file mode 100644 index 000000000..095e977ab --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.6-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-permissive.yml new file mode 100644 index 000000000..3b22a80c8 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-k3s-cis-1.6-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.6-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-hardened.yaml new file mode 100644 index 000000000..c36cf38c9 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.20 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-permissive.yaml new file mode 100644 index 000000000..cfeb4b34c --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.20-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.20 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-hardened.yaml new file mode 100644 index 000000000..007331149 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.23 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-permissive.yaml new file mode 100644 index 000000000..085b60dfa --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.23-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.23 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-hardened.yml new file mode 100644 index 000000000..4eabe158a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.5 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.5-hardened \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-permissive.yml new file mode 100644 index 000000000..1f78751d1 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.5-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.5 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.5-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-hardened.yaml new file mode 100644 index 000000000..d38febd80 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.6 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-permissive.yaml new file mode 100644 index 000000000..d31b5b0d2 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke-1.6-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.6 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-hardened.yml new file mode 100644 index 000000000..decc9b651 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.20-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-permissive.yml new file mode 100644 index 000000000..74c96ffc4 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.20-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.20-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-hardened.yml new file mode 100644 index 000000000..abc1c2a21 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.23-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-permissive.yml new file mode 100644 index 000000000..51cc519ac --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.23-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.23-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-hardened.yml new file mode 100644 index 000000000..83eb3131e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.5-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.5-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-permissive.yml new file mode 100644 index 000000000..40dc44bdf --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.5-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.5-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.5-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-hardened.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-hardened.yml new file mode 100644 index 000000000..c7ac7f949 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.6-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-permissive.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-permissive.yml new file mode 100644 index 000000000..96ca1345a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofile-rke2-cis-1.6-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.6-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofileaks.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofileaks.yml new file mode 100644 index 000000000..ea7b25b40 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofileaks.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: aks-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: aks-1.0 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofileeks.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofileeks.yml new file mode 100644 index 000000000..3b4e34437 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofileeks.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: eks-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: eks-1.0.1 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/scanprofilegke.yml b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofilegke.yml new file mode 100644 index 000000000..2ddd0686f --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/scanprofilegke.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: gke-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: gke-1.0 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/serviceaccount.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/serviceaccount.yaml new file mode 100644 index 000000000..ec48ec622 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/serviceaccount.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ template "cis.namespace" . }} + name: cis-operator-serviceaccount +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ template "cis.namespace" . }} + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-serviceaccount diff --git a/charts/rancher-cis-benchmark/2.1.0/templates/validate-install-crd.yaml b/charts/rancher-cis-benchmark/2.1.0/templates/validate-install-crd.yaml new file mode 100644 index 000000000..562295791 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/templates/validate-install-crd.yaml @@ -0,0 +1,17 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0/values.yaml b/charts/rancher-cis-benchmark/2.1.0/values.yaml new file mode 100644 index 000000000..088f87602 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0/values.yaml @@ -0,0 +1,49 @@ +# Default values for rancher-cis-benchmark. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + cisoperator: + repository: rancher/cis-operator + tag: v1.0.9 + securityScan: + repository: rancher/security-scan + tag: v0.2.8 + sonobuoy: + repository: rancher/mirrored-sonobuoy-sonobuoy + tag: v0.56.7 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} + +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +affinity: {} + +global: + cattle: + systemDefaultRegistry: "" + clusterName: "" + kubectl: + repository: rancher/kubectl + tag: v1.20.2 + +alerts: + enabled: false + severity: warning + metricsPort: 8080 diff --git a/index.yaml b/index.yaml index 25dc734b4..6c9754104 100755 --- a/index.yaml +++ b/index.yaml @@ -2943,6 +2943,32 @@ entries: - assets/rancher-backup-crd/rancher-backup-crd-1.0.200.tgz version: 1.0.200 rancher-cis-benchmark: + - annotations: + catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: CIS Benchmark + catalog.cattle.io/kube-version: '>= 1.21.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 + catalog.cattle.io/rancher-version: '>= 2.6.0-0 < 2.7.0-0' + catalog.cattle.io/release-name: rancher-cis-benchmark + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: rancher-cis-benchmark + apiVersion: v1 + appVersion: v2.1.0 + created: "2022-08-16T17:16:46.308462-07:00" + description: The cis-operator enables running CIS benchmark security scans on + a kubernetes cluster + digest: 4b6789bc256cfbdf251a0f18a13933f0a66dfcb21ccc18cfb8c16c751729c956 + icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg + keywords: + - security + name: rancher-cis-benchmark + urls: + - assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0.tgz + version: 2.1.0 - annotations: catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match catalog.cattle.io/certified: rancher @@ -3231,6 +3257,20 @@ entries: - assets/rancher-cis-benchmark/rancher-cis-benchmark-1.0.100.tgz version: 1.0.100 rancher-cis-benchmark-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/release-name: rancher-cis-benchmark-crd + apiVersion: v1 + created: "2022-08-16T17:16:46.312145-07:00" + description: Installs the CRDs for rancher-cis-benchmark. + digest: 26cc7dd0080126b8ad46b54525ff3cfddeff8143efe2709e236adb13d3f9947d + name: rancher-cis-benchmark-crd + type: application + urls: + - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0.tgz + version: 2.1.0 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true"