From aadede2b8efe4f256ac1df908f46546a53418421 Mon Sep 17 00:00:00 2001 From: Nicholas openSUSE Software Engineer Date: Mon, 11 Nov 2024 14:19:49 -0300 Subject: [PATCH] [dev-v2.10] rancher-cis-benchmark auto-bump 105.0.0+up7.0.0 (#4685) --- Makefile | 8 + ...cher-cis-benchmark-crd-105.0.0+up7.0.0.tgz | Bin 0 -> 1482 bytes .../rancher-cis-benchmark-crd-7.0.0-rc.2.tgz | Bin 1480 -> 0 bytes .../rancher-cis-benchmark-105.0.0+up7.0.0.tgz | Bin 0 -> 5884 bytes .../rancher-cis-benchmark-7.0.0-rc.2.tgz | Bin 5883 -> 0 bytes .../Chart.yaml | 2 +- .../{7.0.0-rc.2 => 105.0.0+up7.0.0}/README.md | 0 .../templates/clusterscan.yaml | 0 .../templates/clusterscanbenchmark.yaml | 0 .../templates/clusterscanprofile.yaml | 0 .../templates/clusterscanreport.yaml | 0 .../105.0.0+up7.0.0}/Chart.yaml | 4 +- .../{7.0.0-rc.2 => 105.0.0+up7.0.0}/README.md | 0 .../app-readme.md | 0 .../templates/_helpers.tpl | 0 .../templates/alertingrule.yaml | 0 .../templates/benchmark-aks-1.0.yaml | 0 .../templates/benchmark-cis-1.8.yaml | 0 .../templates/benchmark-eks-1.2.0.yaml | 0 .../templates/benchmark-gke-1.2.0.yaml | 0 .../templates/benchmark-gke-1.6.0.yaml | 0 .../benchmark-k3s-cis-1.8-hardened.yaml | 0 .../benchmark-k3s-cis-1.8-permissive.yaml | 0 .../benchmark-rke-cis-1.8-hardened.yaml | 0 .../benchmark-rke-cis-1.8-permissive.yaml | 0 .../benchmark-rke2-cis-1.8-hardened.yaml | 0 .../benchmark-rke2-cis-1.8-permissive.yaml | 0 .../templates/cis-roles.yaml | 0 .../templates/configmap.yaml | 0 .../templates/deployment.yaml | 0 .../templates/network_policy_allow_all.yaml | 0 .../patch_default_serviceaccount.yaml | 0 .../templates/rbac.yaml | 0 .../templates/scanprofile-cis-1.8.yaml | 0 .../scanprofile-k3s-cis-1.8-hardened.yml | 0 .../scanprofile-k3s-cis-1.8-permissive.yml | 0 .../scanprofile-rke-1.8-hardened.yaml | 0 .../scanprofile-rke-1.8-permissive.yaml | 0 .../scanprofile-rke2-cis-1.8-hardened.yml | 0 .../scanprofile-rke2-cis-1.8-permissive.yml | 0 .../templates/scanprofileaks.yml | 0 .../templates/scanprofileeks.yml | 0 .../templates/scanprofilegke-1.6.0.yml | 0 .../templates/scanprofilegke.yml | 0 .../templates/serviceaccount.yaml | 0 .../templates/validate-install-crd.yaml | 0 .../values.yaml | 4 +- .../7.0.0-rc.2/Chart.yaml | 22 -- index.yaml | 18 +- .../rancher-cis-benchmark/charts/README.md | 9 - .../charts/app-readme.md | 31 --- .../charts/templates/_helpers.tpl | 27 --- .../charts/templates/alertingrule.yaml | 14 -- .../charts/templates/benchmark-aks-1.0.yaml | 8 - .../charts/templates/benchmark-cis-1.8.yaml | 8 - .../charts/templates/benchmark-eks-1.2.0.yaml | 8 - .../charts/templates/benchmark-gke-1.2.0.yaml | 9 - .../charts/templates/benchmark-gke-1.6.0.yaml | 8 - .../benchmark-k3s-cis-1.8-hardened.yaml | 8 - .../benchmark-k3s-cis-1.8-permissive.yaml | 8 - .../benchmark-rke-cis-1.8-hardened.yaml | 8 - .../benchmark-rke-cis-1.8-permissive.yaml | 8 - .../benchmark-rke2-cis-1.8-hardened.yaml | 8 - .../benchmark-rke2-cis-1.8-permissive.yaml | 8 - .../charts/templates/cis-roles.yaml | 49 ---- .../charts/templates/configmap.yaml | 18 -- .../charts/templates/deployment.yaml | 61 ----- .../templates/network_policy_allow_all.yaml | 15 -- .../patch_default_serviceaccount.yaml | 29 --- .../charts/templates/rbac.yaml | 209 ------------------ .../charts/templates/scanprofile-cis-1.8.yaml | 9 - .../scanprofile-k3s-cis-1.8-hardened.yml | 9 - .../scanprofile-k3s-cis-1.8-permissive.yml | 9 - .../scanprofile-rke-1.8-hardened.yaml | 9 - .../scanprofile-rke-1.8-permissive.yaml | 9 - .../scanprofile-rke2-cis-1.8-hardened.yml | 9 - .../scanprofile-rke2-cis-1.8-permissive.yml | 9 - .../charts/templates/scanprofileaks.yml | 9 - .../charts/templates/scanprofileeks.yml | 9 - .../charts/templates/scanprofilegke-1.6.0.yml | 9 - .../charts/templates/scanprofilegke.yml | 9 - .../charts/templates/serviceaccount.yaml | 14 -- .../rancher-cis-benchmark/charts/values.yaml | 53 ----- .../overlay}/crds/clusterscan.yaml | 0 .../overlay}/crds/clusterscanbenchmark.yaml | 0 .../overlay}/crds/clusterscanprofile.yaml | 0 .../overlay}/crds/clusterscanreport.yaml | 0 packages/rancher-cis-benchmark/package.yaml | 12 +- release.yaml | 20 +- scripts/version | 2 +- 90 files changed, 44 insertions(+), 765 deletions(-) create mode 100644 assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-105.0.0+up7.0.0.tgz delete mode 100644 assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-7.0.0-rc.2.tgz create mode 100644 assets/rancher-cis-benchmark/rancher-cis-benchmark-105.0.0+up7.0.0.tgz delete mode 100644 assets/rancher-cis-benchmark/rancher-cis-benchmark-7.0.0-rc.2.tgz rename charts/rancher-cis-benchmark-crd/{7.0.0-rc.2 => 105.0.0+up7.0.0}/Chart.yaml (92%) rename charts/rancher-cis-benchmark-crd/{7.0.0-rc.2 => 105.0.0+up7.0.0}/README.md (100%) rename charts/rancher-cis-benchmark-crd/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/clusterscan.yaml (100%) rename charts/rancher-cis-benchmark-crd/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/clusterscanbenchmark.yaml (100%) rename charts/rancher-cis-benchmark-crd/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/clusterscanprofile.yaml (100%) rename charts/rancher-cis-benchmark-crd/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/clusterscanreport.yaml (100%) rename {packages/rancher-cis-benchmark/charts => charts/rancher-cis-benchmark/105.0.0+up7.0.0}/Chart.yaml (95%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/README.md (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/app-readme.md (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/_helpers.tpl (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/alertingrule.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-aks-1.0.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-cis-1.8.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-eks-1.2.0.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-gke-1.2.0.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-gke-1.6.0.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-k3s-cis-1.8-hardened.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-k3s-cis-1.8-permissive.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-rke-cis-1.8-hardened.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-rke-cis-1.8-permissive.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-rke2-cis-1.8-hardened.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/benchmark-rke2-cis-1.8-permissive.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/cis-roles.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/configmap.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/deployment.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/network_policy_allow_all.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/patch_default_serviceaccount.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/rbac.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-cis-1.8.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-k3s-cis-1.8-hardened.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-k3s-cis-1.8-permissive.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-rke-1.8-hardened.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-rke-1.8-permissive.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-rke2-cis-1.8-hardened.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofile-rke2-cis-1.8-permissive.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofileaks.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofileeks.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofilegke-1.6.0.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/scanprofilegke.yml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/serviceaccount.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/templates/validate-install-crd.yaml (100%) rename charts/rancher-cis-benchmark/{7.0.0-rc.2 => 105.0.0+up7.0.0}/values.yaml (96%) delete mode 100644 charts/rancher-cis-benchmark/7.0.0-rc.2/Chart.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/README.md delete mode 100644 packages/rancher-cis-benchmark/charts/app-readme.md delete mode 100644 packages/rancher-cis-benchmark/charts/templates/_helpers.tpl delete mode 100644 packages/rancher-cis-benchmark/charts/templates/alertingrule.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-aks-1.0.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-cis-1.8.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-eks-1.2.0.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.2.0.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.6.0.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-hardened.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-permissive.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-hardened.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-permissive.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-hardened.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-permissive.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/cis-roles.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/configmap.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/deployment.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/network_policy_allow_all.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/patch_default_serviceaccount.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/rbac.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-cis-1.8.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-hardened.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-permissive.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-hardened.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-permissive.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-hardened.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-permissive.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofileaks.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofileeks.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofilegke-1.6.0.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/scanprofilegke.yml delete mode 100644 packages/rancher-cis-benchmark/charts/templates/serviceaccount.yaml delete mode 100644 packages/rancher-cis-benchmark/charts/values.yaml rename packages/rancher-cis-benchmark/{charts => generated-changes/overlay}/crds/clusterscan.yaml (100%) mode change 100755 => 100644 rename packages/rancher-cis-benchmark/{charts => generated-changes/overlay}/crds/clusterscanbenchmark.yaml (100%) mode change 100755 => 100644 rename packages/rancher-cis-benchmark/{charts => generated-changes/overlay}/crds/clusterscanprofile.yaml (100%) mode change 100755 => 100644 rename packages/rancher-cis-benchmark/{charts => generated-changes/overlay}/crds/clusterscanreport.yaml (100%) mode change 100755 => 100644 diff --git a/Makefile b/Makefile index 70b0d8958..96a545480 100644 --- a/Makefile +++ b/Makefile @@ -17,6 +17,14 @@ validate: @./scripts/pull-scripts @./bin/charts-build-scripts validate $(if $(filter true,$(remote)),--remote) $(if $(filter true,$(local)),--local) +chart-bump: + @if [ -z "$(package)" ] || [ -z "$(branch)" ]; then \ + echo "Error: package and branch arguments are required."; \ + exit 1; \ + fi + @./scripts/pull-scripts + @./bin/charts-build-scripts chart-bump --package="$(package)" --branch="$(branch)" + TARGETS := prepare patch clean clean-cache charts list index unzip zip standardize template regsync check-images check-rc enforce-lifecycle lifecycle-status auto-forward-port $(TARGETS): diff --git a/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-105.0.0+up7.0.0.tgz b/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-105.0.0+up7.0.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..69095aba341afab7f548b4f3508f799bb31a7e4a GIT binary patch literal 1482 zcmV;*1vUB~iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI>(liD^AzGr@gCVlMS*uZfe-Yz8Vq-`!Y+%FyLcoyVY_yHtg*$8%7|TR^pN{9=&Xf7*NgMcWj72|CY=ha)mh zv=Q+HwMZ1jxA??3OEVxw10fi&`jO>NfiT*mOs_M#qa{*1ai&BfQz0lgv*S}CA|#KR zK|N65>8Okn1yMOf>d=hOk_c4E)geSvVN*88=@619Y#OCYAPm#9faqQ^ZcvRyl*Bw= zLzjHkg5QIgkBFxYm_&OKXfsK;UD3S~Pb|Vah%ueMJpaO?^C`JIlMihaDI*DUY z3(p7xQ3?04Fj5Ojg4QLZ`}IIApeJDECH=Y{s0E~-nJfW4tOsfV{R4`Zfc{<&)B@td z+-AByjmo$4P8hP~ItV-G$|H+W8;Hwi{HNQw2UsHYG@WCZL>O9zjRk*VGmk34AM)`s z8Mhrg$B7*r?E)5aYxA@taQy%dD}F5 zk#8eZW^&3xcV7!@U}JpbV-d>;O+}>jf~P`62z)n~6_-Svgq6(@)6Ymv1%aGSO@%@$ zC5$_mgFK11N4un;v&G?pYOd{Aa#t)mQ=CIn?+(8hn;N$cRvn*p4@<5wKC^UdI;*MR z*>3G%Au|{|$+?fZR-+#kaGfGsHLl{@0eP}FrL%Z{$q)>lKUR!d!|cpK6oMA~yfIwt zZaPLf;fxV>O3^_{0ZPGQ!xu6wBUm)NyP;A-?b>jvHFqcHPTvzP6V3*1RyyF6eX{rT zcidz5b3>EzxLIvBi7loY)eDBdAxD*VKDN?RI2umgRq?WTC8eE?t-*{og}bYbP*xubBgs_dZH3hZ%>|$Q``>rcNc&E$ zX8&*9Dy`87+|&Q>`$4eL|Lga9{kH#i2|IWHZ$+2}8-Z_@n5o;*5nKn&^u^U0oEAVD z>=8<&ULNIMi5C{G6t&bE-0&UH^NAV%BblP&Xi(?3tc3ibdcq;_@MRBt^@Ic9X-b~e zjmtVRA3$!kP7j!PVz~4b)WI=}v%itH*#^BDeZbyvB`y^wdqvn_Fc-BO#djoLbNFqQ z)!G@YX8k9#C)awff%nvZ!S!&kQUCRB27|W#yM&#){>ur|VD(pgqw1*rmI13PKe+;E zxb9o!kE?!q<92={HO1!A8+{k|%;Y0#Q>SUax0ScEk#}S>^+()lYwEv3DQbTexKICY zg5jqA4})Q=|Cg|H>wiX=2IYT}0#>Pi9Dc zVQyr3R8em|NM&qo0PI>{liD~EpJzUWD))?IGca?-+l1t*LIYkP7( zi2&!qfMJ5`agPuR1|l){C>Rr=$HZHT%CKjK;h5yU;_S9yVTgQ8-WZkO8)p{|F=`1E z$HaP@kf^{2)z?dHFm^toFhbDSw~wyv@A_&FB>RF&Gr`B?HRy$?sbbQk|37kVAc{0G z3nY{2drh8&a$|YDIzwhDaZEtUh|zS_daop9^0zZlm_Q!wV4~Ey}_#Xtj*2ugz1C8UQX4*hRjJ zP?_l|1KqzCR>0c$%qJq25t<51n*q;+h!FUGFiS3pIteT5A!c8ZnhFPUDm4`fEtN3t z@EqhxyxZC*1)eQ77g%#6$2xb#pfkofH1zKAo3WvB=kTiIqwaC#YmCpWyR{wFRPgMy zc6cE(7(1P_&UGzEKPlikMYe2QT&2NT0i?wm zp+xHCRvwgiW#O7pOQpdr-2pY9nDPH7GgKT6>U_&e$e*e^90CvDYT&Co8~{&K=UH!D zR+0Gxa;J29K*tl!rJtY^&=SDLdIG!WNCWT)S0#N8q)G-(^{y zoKYI)e=>V>ZT1XkS~(+gr#xvY7fS9<>emU!fF@Zw1!z|7~!y z&Hp#SpyU5b$hrAHbC?$Cf0_bTv43u^n*7!3@s_#&OgBBcBjw^>Ix-LW-{a@|U*RRL zn*XOC?%sd;;Kkv|98-7yI~WeO?thPl!KmZ^OUS?WTz0-A(@aO`0+b(q(H ikj$1s6 diff --git a/assets/rancher-cis-benchmark/rancher-cis-benchmark-105.0.0+up7.0.0.tgz b/assets/rancher-cis-benchmark/rancher-cis-benchmark-105.0.0+up7.0.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..ef4f12dbb1cafff97fa6a5779098bd47e404ea56 GIT binary patch literal 5884 zcmVDc zVQyr3R8em|NM&qo0PKDJZ{s%7e}DbzuNXM@#cq0${F-FXxE_#h^BmIKHzesDioGIb zq_NG5OsXUmH_vAO_Xi{;S#OTx#8Gyy8Z0(4MGc29pP3;=js#);42A1c>0To9XLBO1 zy02$MDDQ^M!*8}gy-yjv=Hh{=N2YgknyWbhBK0 z3(5k%koCC*zor37cX}<11j~D#AI4IlkUn9ud)=>nKJA1;_4}(UFEB(R zF=^-84y}Do-9);*tbDHGJgm(YQ`hJ7h%;nr6?+oVf2Oiu_Z<>N%b$l{&+9n>N?*`O znY8m67WxU0k;@Pzh?p_Tre?5Y+(Dur3#x9wG$L>Y1oU7L3>BIlv2}2$uer~ZisZQ4 z^|j8EULvs>`ck5j-H=bY>}mnbkTV5&@_OoA;mv}JK#m>;i7)@dd?1<&!_|{ zfxyp4Z{N5RF6Klj3}8Y-)ERz2KO_R-nh0t!syJLCL>fy0P^LKC@K}Jtc@z?b(sLX- zCsQ=mhsqS=`X_+Eh)b%txXB>Z&1(XaNs*~mBi_*KIgkPI%qMI$lQfsBbwrL!&)c_L zIOCTwzgf*;PKDqC12@f@T@=|JdIQH1D0wV=lwNpzv(Zkx+7= z%oo}KNbqNb`S!0+Mw@D7iR_vR&gRIJgauVI2&q=?hIb~)9?00A>Eho~Mzvz};AEov z76J|n!U{FXJr*-tTV;fs@G#^H%BF^UNSV$;g8#(Q+@I?L82TtB5jT6L{sQOR)E>c) zMR)_3f|$0MC=~Ew+0-w*gsC>oV{;AQN3mAFy?OF`j&swk{lTlZG^yfmG0OWs;q2_d zJ02i}1G@ zQS&3e)OF|AC4FGmhu$2OpuYUT zg&M=F-mB-d$jwr{{m-;>_hN=&ghF~Mdax_7ZvHnMj7s+Z@UY*`{~DoBpSs_|F_W=C z$fiZw#7ndqT9P?}hRn@kh63T+?&r_Wr%$f7PLv^Z^!z1zvIFjCZQyhU@6^sTymuMj z+svkQY9?OxVg0B!hWfftkj-?FaJUeO0$DyqC*b|ldahOhrPGpH#gjc23Ch$2I{#mG zI}c)jp~UP*r&^0rjk@1D|FW~gROi8hh9Qt3$ePC}bYo1+bkb;fx##FCml*OzlAKe+ zTKO-yxC%K5B=|fIbykr641+jC<2R@omzd}1RC?3gbd3?pF}HPc;R?0B&d-Xqo;IH2 zIC)kl;ADcn8bjwDKTFEj$(e5lo#WqP5_VSibxsVKSUxL5(ReOr<#|rejj6AR*6Dv^ zNGY3&IK+p}2iNHT-srGj)c=Ft;X$v}|4mRyZ(6^}OPnT)de<#1*vvW8ZWv`#&*uWU z^n5<=UiY0V%7QU`;K5s)!Np#e>hE9X+cU z8&59riH!qj79igkFWe?TacQl)R6nIDWWHE%V=_ zWY*z-xyVbdq}%s;4^RT@@INT~e}n#@UH@r@%IGdaCPVdW>!|4I;c`{Jitl8MWC%_C zn-6xuTbK-bx<%P?QkoUr>3jWsuh;o+f!0?+_s74^(f3|G3I2x_{2#XVzY*Fl{*y7X z8vkZpXC?dx2QB;?ru*X`jcy-2zyny1|AR9ANA3InW@x+k&&J4V4S=l&@Fmgx@jt!7 zr^5fiVHN+a{cnV}i~nqltj7QJ3fJRb&*pz$;Um2Aes2}T)@W1wA2ekD+xI`s&{N?5 z;1T#A{H3-3P161Ge>Ifp8h|?^B0z@0{ZzqP{Ey1(|HJ*^L5u$;XuJ5Y8zZY#!PW52 zsX)6L&;UIQ|7O3ll=S*u?*!N5zr6l8>hF(Q{5L^QhyUdmX*Ix?OZUgWxWeY_|3T~j zH$&USf87{ajefCaD$t_;>FHtke{%aj81A?DZ-Sl<|M#)~tp<2*+6e!HhdBV7<9~SA z8@Bjwg0_zT>KM5b{(~0(&q@!(|3(hLdi?K~?f-Dl?*D6qo)G`{bO2fn@SL;`|2kdp z@KJ}s*WiE9@0Iue_WJwn`hO!-#=p2EzDHs;)9BJ-NHgw2X$44Nh5iHxhh8L#(}5n`&-~RI1J|E9+T~kWs2DeC&`Yl7_)D z-5iq&``_>N24(v{=(p>CjZmVaO)tMCQ8_eIRbeM5l-+uDy2&xVlUO)A>j!TitLzl5;#kMx{1&MJ$o3#t!tFjU;Eym@Ad2&WFk>+3gY&?LC<9T+jnbo zzOuXrwan8A&Y)NGaJ7Woe5furUdb_Z@Jgn)wNjqydUd8t@pK|FIY}|+)lerEUb|LG z(fN{I8{2dDxqR*9>W@w9^nZX+$ZzJz9uW?5js72vD(63Yqfx8>8=<_u*Z$|yZ~r0d z`4w(^?gaHFY9EqNN!H!G*AeY)ANWoMO!(w#rztG3yf;&TR7`V?;+pz+RqML z+$00B8B+N>;D9DQr-toHR*{f?Uid zJFF}ryRMdScKrIM)06X`FV0>cy}LMhd-V6?Tv18+K73ZO8Sf*?#re_SYsI;v z5ZeJ&?(g5d|Nf`Q|89zEw+kuc+4Rle3GXH^-;vXBTge&reTYpIv-- ze|lc!{9@fWd2tu-v*Ujr>%O^D;)HD)Mr@6^$M255e{=l9eK@8;H*!IeOw6(l+`?}$ zS6Exro1f0kk54b&9lfpT?tF6;BO2wRt*va8_aBZ=kIvtpUi@(U{ZBRB_~K3#5#VK9 zR1&3FBc+&gUQNKc^#Ja zX+Fh&Ci5^WY#Fuj78qp#G6ns?l2a+F-zT8V5944}@FOqB<`q;UUgg=@+hu_YIc}lM zt5D5Ce7_a472-p!6HgU8wJKe)FYXjhCz!yL8Gw@DgUc*gI6|k|KV?ZPJ^kE1S(CKR z|7WNcTwGm5#;#wGFyssU|0c76b?<+N`(^)sIBes;G(+VD{iMGsn^qR`-`QK%!@FZ; z$cz#F{{zE1MLZ}(I|ZO@Do`eG2TTf<6YTgrzlqY92q*R#bA4`nNH>GRmBaxkeLn)AGsAH1$ys;C z`Bi5O5tl0ce#D;r6-QG+0<30t?aNlzg1IvWlPF`~M+`97gG-!nfv!n5FKa1hncgVQ z>K{KDZymIUI%onls8qTZ@J>&a)~;}v;bbXU*XTTGwwlaylGxCz7d1-x?98*XdPSr9 zXemp6lHl|CoM-@j>?8%`b`U_PINt0w15+)1=|=khPyg(9wcVB__Qsd-Q9vd-RGd;5#y09+FPiccnQ=$xuC^jj18N27K2-)!)BU*#E;( z`TcMIuz%R@|89h~w3#QrW=^8WD~4&l`%^=8PZ)=R>1jj$b49hUAJR9`Ld%rwA}Z~7 zajgQ(7V))~FD&D@(D~LxvQBqA*@P;ax+fzZm@wFGrq|P-%Y8ISf(g1^%$wK%SuTEx zD#>Ve*(40@1~vO5*`sEE*gZLkK=!&S{mKrmtCnuhOUeSurdfTKExr2A+L~15x=e*H z%kUq5Sz))TIig$()HTf(x2`?IXqP@=E|aSVcwO^l7Qb%%RflbUC{_ovz$m1?X(;W) z2_A+h?l)`~)d2}#@Q7SJB=cj^4nWQ-V{|oNeaCF_tMJu#0)lhSB-#$JN!dHtWm?h? zg?v&Gg_Af;6LUK^?-nLjT>2!WY+5gq=@;#?hY=6b+~saxQ%Ge=slKQro0$t z&wNov!YYeii^mEY*RiP$ieKd#2|hAm$?2&frd#eSX+g#N-XNiJ#^z|uD zv^;4m-cd^jplXcQ`hhaO{15udV8cFMoI}@hs4N3*g2nCkTh;nE)|XrEqg4Klx~1vf z_!8lh$IXVO;bA?v8eW^@>Tw;|6mFk;2L8OXZv7{>zx%;o09gC}x3d4ge=us_|1?6I zpZ`sE=C6+apKdL$dplG;HQ*IXyo_n6C>ujZi5NTC%bjd&<|Q>-^`E;1zi!$D|Md|- zA0Pi?IIQgdINWd7e;c7~;=k?~N)`m;_C_#X#t z{Le<{sqtSp?ADY9$QAnB?fa$ECioX7y8EWlKksAz%lIFT+Vj87&^Ga(KTn&Ek>oV( zQzE}M=;(8|>(@dL!T)B_KOf@%k9uwV&t~YU@LxGk-;@SuZU08JA^z(kfId3@?{HZD z{?Dl2e*dc(+A{vD(JmTV0H}{V`rNJi<S7{Nq#M zf7mOp|MmNA{O@LHoA}4Z@W1@d_;a`4*G?PYKlcIPZSVi7*#G_Z{eLsGP5kEqRwiEo zep)TC{Mztyx8m1Jo8iAX``>HV{~Mtv!ha*kZ|(o%X)XRA6!E1<>+runD!>2h4|}cu z-w2iBeb?@}FC+c_kzUvD)i3Lx?aS~Shjoi}eC|HJi`L=)nuIhU3eylit}pJr?33{K4#W2(;! z!lnq`YZ8%58d613dPg5l68$H0Iq3vuME(PB((+y^ex?LvQ}A|^eE+W`QXz|WqH_F@ z1uK79ss41a2Y(;Tf(y-(M$X-%VMflkVN2bF%=j<=QO=~efon0A`r~$7&i6b zgHf80=o3&g1fL6mGUDc(n|=iR84)T8_myVV_tcC^d($(+Zf*5)Kb{+EUnJG*|I_26 zAKo5&^I$7wtn>dygVOp>e{^ur?*C|ncHq>G0C;_J2ASrB*BWDvbFR^ubKk%Qsg@vO z#tc|b&X)5tNCPZ``H~iJ1_YMgQ}!Jf!UC8g(=0Xk=TS(tM+M1ewm{8@0-rFrL!dnWFIYO)p9F zd_M2a_`+4(oyIgk*(JfXR#t%Rj4~(_q0Oo4RU76FcGHoog3ZI|ETDG4~`~!SXcuwp^VDeo*hH^ z3Z&LS7gjM4EA4{|XNIi{N2UOv`g!e7zWg=koBz6NIRrSN3?(dP$n?-qf=;Ii5;6mp zAKsTlVvr`EvJWx{Su zU6|#Z3XZDPUeV0i<8=*PbaqlkifdRTx^D>^AQBcBhWf95*sP?K`YIxV%u%6`Nw+rjfW@w83u8Pdu9kp zJ>9aOG_lCaL)}YacAXdn0Sm&EZa-^a(x((Rz{ZeXqn<+=E~SD~7|A`uh@l-3$Yd#_jb+vJI!a?$#fErRnp{Xw;Tll)qF@8 z-V_^FqJm#-=CN5>_|+-|1RE0>em;8pMk6*X%-6X98|}L^d3T(h9W&%|7GgR2WE^Ql z>NvM>W`-)<<}(IVDnTz})8e;wJfzCA87hdA>Cs!~)=en8sL<*=Pe}EJ-a5CY4@`x$ z=C7~n$7ECOoi0i0HyAIds{~?qPBdJ*5%I6c6ubUp+D$m^u5aJ#zBf4db15}1uehr3 z>|6L)e;jBF;@30YO~mQDC7~Z8Z+diL%hIN7chf@eBky3fymdRRwK8d%A0IXw3@n!ya$cTs~hPr1rvAs2U>V+sil^l So&GNX0RR89PZbaV&HwDc zVQyr3R8em|NM&qo0PJ0RbK5wQpMOuEqD$VZ#B(O~@*}I-*(y)s+wyE)WqWpODm&#s zWJ|(|0yqF@jW70hzXCu~e95wGnND`tm5M14Y&0If?gj`n1!3M4h2v4_jF5TLIT5qY z>nRb+y(aVEyDd<++wC6i@0-8fZnyZici27ruD5^GJsceL`~B{B-QK~VKll#1+bDb; zMN$#*UH8#t6)X3R5Mhifq9|u_*aGl~A_1Sc9#JYlm+}sY6n7|-iUh$BDu;{X3IB&V zQQowYgNH)VF-1RpyfT|lWf+iahmkoB;q~b`{FoF_nSU0I(78e(DQ81?@z)=q=k{N@ zU8f6wfu1|)>&q9FkLn_1NIV>Zt_TlN5XFTfucg9y4aS6`);orSHAD|daElhFhC+P zZs*Dlt$a>hhq}G2e2(HgsLU2o$K&&mGh}KNdlJ%rB(h)iS|kjYKaX5p4dJ={mXFdC zG*srs#T0X$1<1%KKnWsZjIxOtF=-JX(TfCC*I-%_I0FKD#0Z88O}E&Jw5X@KPn8Pg zu+#Ch;*)MHwi*9YqLQ6}Pq^%80nE5F1-bHS(wgD*f(u^`TTWVN>#nv-T1%!yLy!{YQyi{&BtYRj42VMMwpw&fCTOe= zl?lA{PXK`-msD|aoua9eRRSiHA``7f+<`@t)|m+q&ppCcb4qeKT1RA9b=`vuE6(^R z;@7L$%&8DupzkDE(~CUMBe&mb36wk%9?BtnxorXLz&{Zp8Id5k27w-*&yo4SxY8{r zL-gqQ8vMAA(x-tiUuOuATp=jkEkt*V$C>mfkECJkO*!?@bg7!^Vo981!WV%J)lfyA^yK3Y3|Q;0SrBql8Ea)Q-6VTZfcL{4GLx-zQo-JMff=Q=@0bKqkAxBfG9FV#)wPvx67UfTV%JgyXkla>tyuG%;e<-18?xOt zcVpB1-WXAnrW?vr!DmIaPBtT)i&^iqMQgn$|D2${FBA6X|b5w$Q@*@{& z2(P-Yy3c5v>!51;pK9mM+T;U{_$>{BO|TFWCR1qh2%rtA)ON>3k0-Ohy7B zofc^mFVX5{N#+O|DA$WA3WV=Fx3{e?UmR_dC_`xL`Ahm_8=PBh)^rB<%+562_bK0- z)RMI;CSLYo{irs9`Z`yT&2$-axD>J4SUyF^;QqsUu2$_N(~?SclRg#-%G4Oz|1CT1 z2Qk1vV)~<9u0^3no$p)!w6nuR)4_rU0TAC$o5!eeV?xYy(&%=%*V0)=81O}$oKe17 z!0hFVK!XT@4O8_#hV zKdTdPJVs9qq5Ynp$K~tf)VG87$!`$}+N=9IBZiFaos}VPGMBURET`wj)VD!5<(wBC{%yGj=Ij+0xknRBL{FUlsa#|3if zdVJow>a}K+`9t`~{dYD;YmSQeL=o+Ll~+VU?mIEB_=mY3=08Wt zti%6uk(bP*({sBIPy*}l-!J-q{a*jzpuv9~R77_kGAXKGTSrAt3YV+$WqikDBt>ZK z-+Z(S-oj+ilPt=XQ_-~OcF*k{xZU=D3beinxY=B= z|KTI>-~V%C|Ldgt<9{}g$r^w&CBjFB{{2+JTKw-9*Z&6xgMNemI%vE2uNot(Rl#g< z=Tx9s4XA-0hJUl)SxS0!uXlp$@n2m3+wUDT`#)=;r^Ekpj5HeH>!thSU(B#R`+wN@ z|Mk#z@n1DYR-<36nF=)Me|mZt{-50b_XoWO|8>yQ;r~ANztI5CO&j6A|1bw&bNmku zkB%Dr*Fjsye|e1D3IBeB|7WEK;(sFtU_Jg1iuQldYxe)uLQjbQdpZD(26#?dhkuO}U`|XAb|kvsbc87o70`S8M?!{+zOw zhysi^(vy(>P4Fm8cjh~JMH8RvOwQ{rGcBWGq=Qpd-3k~hSD%t zrkf*k`d%eI%`@LrUuNI1RwCUw{BrJwzDl6>xgtAkuPB%Hmm+)PN zpvlZKKE^yDM3Ekojss^2P}d>0K+hhAaN`&y^_QO8@3~#O1{q6~nSwYyx8F4x|N6t) zoUbhJekJo{g46F-JX|gzGastTjWaofHqK;nTPx*>u2*}q6i+7-lau6g&IUR$_u92o ziq04J+R&c6&*W<+SAT3;r~iEn1AaY6_K0whYxMvAe(C&YcYnXp|Fuw7-)sMK>9@a0 zdwzx6o;g9iiQ0!aK$3Mg?{!3b+XucA0b@Ry+Gz@MEbq+}AQ97Cqqw3T9(x{-n0jAo zG$+nLY=%UB&J>{xMaCJgY;a39a2mYGwfV|0DZ2H)d`XY`n}^*@$TfEvSP5=#hj(UG zWCFLhFY=OnjDp}J52$xNgwyeRu09Hsm{tzVdHPJlX6lw4u!oe=rm&%yGSb8`3Nn$J z?69(g?5bSC`N`{_&rUCXxjcV;{QmOv-SOW}GDXGlOCHgR*`QhZX1tFmmlwx>s}$#s zLTm?=xqo>7;m4mp{PGlajDy;(t6xrn`&KRCy`oyLPtPxp-=3UZoL{~>xi~w0eSZ1z z!`Vfd^NV%koSa?0KYmxy-Pz{IM>NXBSX_6wv5$y1B@~snSx$_$*B;_?+Z}o1(Clh_>r4o^9srlud?jy?V>=r95+zp zm8)hhs^1FPa`BgQEXG7&P%;>Y?I-e%#-bO-c*-@9iz?;oY$^ zWX6d8|AAqhLhk2coB~ib5h&xg111HF33hy5T!+a^gj4&BxjwO%&)wEvBdx=~dFhq9 zi1|s&eRaUP_rKj<@%;CGufcykRK)*C_xBR>Kk-oo(#@c7BxwN@z8?Y5o?A$b!mv`q0XqQZU` z$11>d5npTh+%k>>?e9$_>tx51O(?UedNSm`34`sVdOi8M+(#29n4sJFys-_C#o{NZ z;*4gOP0Y}4P_sYcJ!D71E)}$=gC=tFW z!@v2c#BNn{gqaqoYML!>U3-SnEjlR(s!`Sw74H~ z`J^HW$5D_ZW_E7gEli}i^hiM2q*^A^FWO}fLhdKIi`~AakkXP;by0CPGxwudQ9|5n zxxw{FfZwqxH8n5BuGEbA`!1Pnqz$ro&Y~e}Ix?VLf@GyV*+_4%EhgS+eb3sIY->)R zd7_AfRTjMxk0ms&V^bLvzsxlhe2!|0ku*J*XKbz6Bkk0WRtrA2xvFx`Vg=pO*Jn7^ z@+7TzM=e_bWn;Y750ug9-{>iW4f}Y04qeTmv<$Qf7PsGTW$RyCUv9aN68Sgkmb!c6 zYlKf0HyfIUhxOoUcx{fW$8}&`xP9&!`18`b^`FfC?gxJXVD0C5J zuZNx*|GC3%b!mW1q0imEUpsAre_^7#ZyNpcKK8$e|G|E9{B0ElU;$wL{J*&Vzkkqg*8gjvC&zzn3jnKP zk3M$`f8DeJ{>e<+s({Dt-U2*WkY%+9v)pv8kRI>%@F#xZ7a+(X;{n@u~1X z=oZ)idc7w8cRjRC{9|qSUw&u&x!dnsrw#C*`2g^?_y3ga|3UNqzaH8q{xbn96iIwa^pczZT>-_W$v;7XJ^5_>!k}_&?Y$zW?j>j~f5K z7AnO1uH189MEd*nkD+v)q z69o4)3CV~CR8f@f@yF9x|H({FI)*8cf5+>jyqAifD?!-=+}$|ee-%W^WzkMlh95G2 z{Pxw2PO6q=#dFCW~iNB>;Ox1Fd2>dOg0)1$oC0DP{-bf$StpD`(4-cCCAGOd9oY@fouTRe*)tvBJW31J>(CEy#Z(xH|OArxb z2CS#&%lR230hYmhNeegw0!!~H{f-M^K1`5lmKyx?FreC_g7`CApr%BDM;MF{e7;}- zCqDXatF;5CRu|aFf344-KewhB%u{VrIh?`mfMeqYT4&8Th~Th-XKDh>8J^GGEA>$| z{z(`*0*ODzZRmiz@!#tn7UO^R4vw1hpY_lR{7Vh}#MGvs&%xWkpO38pkAWR&6Azy> ztCz2l>7+3iaH_8uDmafB>@IbN{PpEjsZb6(oyB6|dNe7-Kz??8LLE-9~Zk*DLiKvgVL;NePtb8YuD3Zi9$btQ>CCs#6tevD4i3b5+=yuYYk27RS4qGh; zK4rDhQo0FM(`aM_iG}K9Gwy-|B`rNA%-0o_5N(rsu_Udf*P7Lla&JIlPg zpg0e#QWg=DKtM)Rq3(R$(+agW$eAg_M3~Zdu60BIy`=kHI3DX^VGYEXGAgHgb_``J zkXQ#@Sjj-Fv=0uP8@3J{n*xC9=e0li@^i*F|GaBC_&BBvB`l`M^w3a(P9`xDQUjJ9 z-XkK>PZI6ZJ|t_IaGZ#z``s8DABd@}&Ys9)YJ;dE*(=Z?pVb^&S(gf*^*NRE>sP1 z0%KgHU$CgE0eF#Ae7=m0V}toKTTY0+EjW?ewA*}+J|zl+Yu)FO?gqu<;l1oH-K0ww zW;v&V<8rlEG;{iRRYT{UorIC%8WyqcTfzp2garnH{;MB0D=CG(3W*?dR48QJZI5Z+ zrRb#=)(vwUpio-Gv$WlvMESpv1^17HX|Oj4P)QAEQ%jP9!3=2Q;Yn|beiY!I8A4J| zx9lfPEV8mtcjK5{r$#}*f-t4q&l;HIDa8%2F`!qd=a7a=q2L5Ya?dbgXh#Gx840uv z`Dt0XcWHPgBVy7NB@-*?3kOeC3Eb(T{Hhq^4WGWox~#*H+j-6$G%TB9})!D z`G%FK;IqvU+47rSjSdKm!g<6re zS~qZRhAP}-Gx}62K}V5k@f$lH66IMB<-|$#=uPX!i7CA((ds)-NY#bjv~ElvmBXSkzT`SI3)(~~#+#j=UdlqD<= 1.28.0-0 < 1.32.0-0' - catalog.cattle.io/namespace: cis-operator-system - catalog.cattle.io/os: linux - catalog.cattle.io/permits-os: linux,windows - catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 - catalog.cattle.io/rancher-version: '>= 2.10.0-0 < 2.11.0-0' - catalog.cattle.io/release-name: rancher-cis-benchmark - catalog.cattle.io/type: cluster-tool - catalog.cattle.io/ui-component: rancher-cis-benchmark -apiVersion: v1 -appVersion: v7.0.0-rc.2 -description: The cis-operator enables running CIS benchmark security scans on a kubernetes - cluster -icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg -keywords: -- security -name: rancher-cis-benchmark -version: 7.0.0-rc.2 diff --git a/index.yaml b/index.yaml index b41346443..33056cab7 100755 --- a/index.yaml +++ b/index.yaml @@ -9357,18 +9357,18 @@ entries: catalog.cattle.io/type: cluster-tool catalog.cattle.io/ui-component: rancher-cis-benchmark apiVersion: v1 - appVersion: v7.0.0-rc.2 - created: "2024-10-24T10:31:04.343361694+05:30" + appVersion: v7.0.0 + created: "2024-11-11T14:07:25.870024509-03:00" description: The cis-operator enables running CIS benchmark security scans on a kubernetes cluster - digest: d60489eeb4de5d34679b8f9337668c52bbea7c4f03ec14108d83c362acb60700 + digest: f884d1167e7ee227e8cb67dbf96a7b0bd0e3351660fa6ebc2dd43ada78eebd76 icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg keywords: - security name: rancher-cis-benchmark urls: - - assets/rancher-cis-benchmark/rancher-cis-benchmark-7.0.0-rc.2.tgz - version: 7.0.0-rc.2 + - assets/rancher-cis-benchmark/rancher-cis-benchmark-105.0.0+up7.0.0.tgz + version: 105.0.0+up7.0.0 - annotations: catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match catalog.cattle.io/certified: rancher @@ -10023,14 +10023,14 @@ entries: catalog.cattle.io/namespace: cis-operator-system catalog.cattle.io/release-name: rancher-cis-benchmark-crd apiVersion: v1 - created: "2024-10-24T10:31:04.352437187+05:30" + created: "2024-11-11T14:07:38.486536563-03:00" description: Installs the CRDs for rancher-cis-benchmark. - digest: d2ef89e55396bbfa91ff81b1772554d1e6b136c4238e1e4170c1d8ed1ea2da79 + digest: c5e6f304babe0f86c8b51ae2ddf46178d0cad69ef366fcf14c039f6d856f6560 name: rancher-cis-benchmark-crd type: application urls: - - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-7.0.0-rc.2.tgz - version: 7.0.0-rc.2 + - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-105.0.0+up7.0.0.tgz + version: 105.0.0+up7.0.0 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/packages/rancher-cis-benchmark/charts/README.md b/packages/rancher-cis-benchmark/charts/README.md deleted file mode 100644 index 50beab58b..000000000 --- a/packages/rancher-cis-benchmark/charts/README.md +++ /dev/null @@ -1,9 +0,0 @@ -# Rancher CIS Benchmark Chart - -The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded. - -# Installation - -``` -helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system -``` diff --git a/packages/rancher-cis-benchmark/charts/app-readme.md b/packages/rancher-cis-benchmark/charts/app-readme.md deleted file mode 100644 index aea7514ef..000000000 --- a/packages/rancher-cis-benchmark/charts/app-readme.md +++ /dev/null @@ -1,31 +0,0 @@ -# Rancher CIS Benchmarks - -This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/). - -For more information on how to use the feature, refer to our [docs](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides). - -This chart installs the following components: - -- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded. -- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed. -- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans. -- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources. -- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish. - - If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts. - - Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart. - -## CIS Kubernetes Benchmark support - -| Source | Kubernetes distribution | scan profile | Kubernetes versions | -|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------| -| CIS | any | [cis-1.8](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.8) | v1.26+ | -| CIS | rke | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+ | -| CIS | rke | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+ | -| CIS | rke2 | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-permissive)| rke2-v1.26+ | -| CIS | rke2 | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+ | -| CIS | k3s | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+ | -| CIS | k3s | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+ | -| CIS | eks | eks-1.2.0 | eks | -| CIS | aks | aks-1.0 | aks | -| CIS | gke | gke-1.2.0 | gke | -| CIS | gke | gke-1.6.0 | gke-1.29+ | diff --git a/packages/rancher-cis-benchmark/charts/templates/_helpers.tpl b/packages/rancher-cis-benchmark/charts/templates/_helpers.tpl deleted file mode 100644 index b7bb00042..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/_helpers.tpl +++ /dev/null @@ -1,27 +0,0 @@ -{{/* Ensure namespace is set the same everywhere */}} -{{- define "cis.namespace" -}} - {{- .Release.Namespace | default "cis-operator-system" -}} -{{- end -}} - -{{- define "system_default_registry" -}} -{{- if .Values.global.cattle.systemDefaultRegistry -}} -{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} -{{- else -}} -{{- "" -}} -{{- end -}} -{{- end -}} - -{{/* -Windows cluster will add default taint for linux nodes, -add below linux tolerations to workloads could be scheduled to those linux nodes -*/}} -{{- define "linux-node-tolerations" -}} -- key: "cattle.io/os" - value: "linux" - effect: "NoSchedule" - operator: "Equal" -{{- end -}} - -{{- define "linux-node-selector" -}} -kubernetes.io/os: linux -{{- end -}} diff --git a/packages/rancher-cis-benchmark/charts/templates/alertingrule.yaml b/packages/rancher-cis-benchmark/charts/templates/alertingrule.yaml deleted file mode 100644 index 1787c88a0..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/alertingrule.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.alerts.enabled -}} ---- -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: rancher-cis-pod-monitor - namespace: {{ template "cis.namespace" . }} -spec: - selector: - matchLabels: - cis.cattle.io/operator: cis-operator - podMetricsEndpoints: - - port: cismetrics -{{- end }} diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-aks-1.0.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-aks-1.0.yaml deleted file mode 100644 index 1ac866253..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-aks-1.0.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: aks-1.0 -spec: - clusterProvider: aks - minKubernetesVersion: "1.15.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-cis-1.8.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-cis-1.8.yaml deleted file mode 100644 index ae19007b2..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-cis-1.8.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: cis-1.8 -spec: - clusterProvider: "" - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-eks-1.2.0.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-eks-1.2.0.yaml deleted file mode 100644 index c1bdd9ed5..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-eks-1.2.0.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: eks-1.2.0 -spec: - clusterProvider: eks - minKubernetesVersion: "1.15.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.2.0.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.2.0.yaml deleted file mode 100644 index 426f7ec6a..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.2.0.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: gke-1.2.0 -spec: - clusterProvider: gke - minKubernetesVersion: "1.15.0" - maxKubernetesVersion: "1.28.x" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.6.0.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.6.0.yaml deleted file mode 100644 index 0538240e5..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-gke-1.6.0.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: gke-1.6.0 -spec: - clusterProvider: gke - minKubernetesVersion: "1.29.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-hardened.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-hardened.yaml deleted file mode 100644 index 07b4300d2..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.8-hardened -spec: - clusterProvider: k3s - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-permissive.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-permissive.yaml deleted file mode 100644 index c30fa7f72..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-k3s-cis-1.8-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.8-permissive -spec: - clusterProvider: k3s - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-hardened.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-hardened.yaml deleted file mode 100644 index d3d357c02..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.8-hardened -spec: - clusterProvider: rke - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-permissive.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-permissive.yaml deleted file mode 100644 index 208eb777c..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke-cis-1.8-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.8-permissive -spec: - clusterProvider: rke - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-hardened.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-hardened.yaml deleted file mode 100644 index 0237206a7..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.8-hardened -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-permissive.yaml b/packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-permissive.yaml deleted file mode 100644 index b5f9e4b50..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/benchmark-rke2-cis-1.8-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.8-permissive -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.26.0" diff --git a/packages/rancher-cis-benchmark/charts/templates/cis-roles.yaml b/packages/rancher-cis-benchmark/charts/templates/cis-roles.yaml deleted file mode 100644 index 23c93dc65..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/cis-roles.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cis-admin -rules: - - apiGroups: - - cis.cattle.io - resources: - - clusterscanbenchmarks - - clusterscanprofiles - - clusterscans - - clusterscanreports - verbs: ["create", "update", "delete", "patch","get", "watch", "list"] - - apiGroups: - - catalog.cattle.io - resources: ["apps"] - resourceNames: ["rancher-cis-benchmark"] - verbs: ["get", "watch", "list"] - - apiGroups: - - "" - resources: - - configmaps - verbs: - - '*' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cis-view -rules: - - apiGroups: - - cis.cattle.io - resources: - - clusterscanbenchmarks - - clusterscanprofiles - - clusterscans - - clusterscanreports - verbs: ["get", "watch", "list"] - - apiGroups: - - catalog.cattle.io - resources: ["apps"] - resourceNames: ["rancher-cis-benchmark"] - verbs: ["get", "watch", "list"] - - apiGroups: - - "" - resources: - - configmaps - verbs: ["get", "watch", "list"] diff --git a/packages/rancher-cis-benchmark/charts/templates/configmap.yaml b/packages/rancher-cis-benchmark/charts/templates/configmap.yaml deleted file mode 100644 index 094c9dfe0..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/configmap.yaml +++ /dev/null @@ -1,18 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: default-clusterscanprofiles - namespace: {{ template "cis.namespace" . }} -data: - # Default ClusterScanProfiles per cluster provider type - rke: |- - <1.21.0: rke-profile-permissive-1.20 - >=1.21.0: rke-profile-permissive-1.8 - rke2: |- - <1.21.0: rke2-cis-1.20-profile-permissive - >=1.21.0: rke2-cis-1.8-profile-permissive - eks: "eks-profile" - gke: "gke-profile" - aks: "aks-profile" - k3s: "k3s-cis-1.8-profile-permissive" - default: "cis-1.8-profile" diff --git a/packages/rancher-cis-benchmark/charts/templates/deployment.yaml b/packages/rancher-cis-benchmark/charts/templates/deployment.yaml deleted file mode 100644 index 8c9f72f5d..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cis-operator - namespace: {{ template "cis.namespace" . }} - labels: - cis.cattle.io/operator: cis-operator -spec: - selector: - matchLabels: - cis.cattle.io/operator: cis-operator - template: - metadata: - labels: - cis.cattle.io/operator: cis-operator - spec: - serviceAccountName: cis-operator-serviceaccount - containers: - - name: cis-operator - image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}' - imagePullPolicy: IfNotPresent - ports: - - name: cismetrics - containerPort: {{ .Values.alerts.metricsPort }} - env: - - name: SECURITY_SCAN_IMAGE - value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }} - - name: SECURITY_SCAN_IMAGE_TAG - value: {{ .Values.image.securityScan.tag }} - - name: SONOBUOY_IMAGE - value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }} - - name: SONOBUOY_IMAGE_TAG - value: {{ .Values.image.sonobuoy.tag }} - - name: CIS_ALERTS_METRICS_PORT - value: '{{ .Values.alerts.metricsPort }}' - - name: CIS_ALERTS_SEVERITY - value: {{ .Values.alerts.severity }} - - name: CIS_ALERTS_ENABLED - value: {{ .Values.alerts.enabled | default "false" | quote }} - - name: CLUSTER_NAME - value: '{{ .Values.global.cattle.clusterName }}' - - name: CIS_OPERATOR_DEBUG - value: '{{ .Values.image.cisoperator.debug }}' - {{- if .Values.securityScanJob.overrideTolerations }} - - name: SECURITY_SCAN_JOB_TOLERATIONS - value: '{{ .Values.securityScanJob.tolerations | toJson }}' - {{- end }} - resources: - {{- toYaml .Values.resources | nindent 12 }} - nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} -{{- if .Values.nodeSelector }} -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} - tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} -{{- if .Values.tolerations }} -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/packages/rancher-cis-benchmark/charts/templates/network_policy_allow_all.yaml b/packages/rancher-cis-benchmark/charts/templates/network_policy_allow_all.yaml deleted file mode 100644 index 6ed5d645e..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/network_policy_allow_all.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: default-allow-all - namespace: {{ template "cis.namespace" . }} -spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress diff --git a/packages/rancher-cis-benchmark/charts/templates/patch_default_serviceaccount.yaml b/packages/rancher-cis-benchmark/charts/templates/patch_default_serviceaccount.yaml deleted file mode 100644 index e78a6bd08..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/patch_default_serviceaccount.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: patch-sa - annotations: - "helm.sh/hook": post-install, post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation -spec: - template: - spec: - serviceAccountName: cis-operator-serviceaccount - nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} -{{- if .Values.nodeSelector }} -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} - tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} -{{- if .Values.tolerations }} -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} - restartPolicy: Never - containers: - - name: sa - image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" - imagePullPolicy: {{ .Values.global.imagePullPolicy }} - command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] - args: ["-n", {{ template "cis.namespace" . }}] - - backoffLimit: 1 diff --git a/packages/rancher-cis-benchmark/charts/templates/rbac.yaml b/packages/rancher-cis-benchmark/charts/templates/rbac.yaml deleted file mode 100644 index 5fe075e34..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/rbac.yaml +++ /dev/null @@ -1,209 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-operator-clusterrole -rules: -- apiGroups: - - "cis.cattle.io" - resources: - - "*" - verbs: - - "*" -- apiGroups: - - "" - resources: - - "pods" - - "services" - - "configmaps" - - "nodes" - - "serviceaccounts" - verbs: - - "get" - - "list" - - "create" - - "update" - - "watch" - - "patch" -- apiGroups: - - "rbac.authorization.k8s.io" - resources: - - "rolebindings" - - "clusterrolebindings" - - "clusterroles" - verbs: - - "get" - - "list" -- apiGroups: - - "batch" - resources: - - "jobs" - verbs: - - "list" - - "create" - - "patch" - - "update" - - "watch" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-scan-ns -rules: -- apiGroups: - - "" - resources: - - "namespaces" - - "nodes" - - "pods" - - "serviceaccounts" - - "services" - - "replicationcontrollers" - verbs: - - "get" - - "list" - - "watch" -- apiGroups: - - "rbac.authorization.k8s.io" - resources: - - "rolebindings" - - "clusterrolebindings" - - "clusterroles" - verbs: - - "get" - - "list" -- apiGroups: - - "batch" - resources: - - "jobs" - - "cronjobs" - verbs: - - "list" -- apiGroups: - - "apps" - resources: - - "daemonsets" - - "deployments" - - "replicasets" - - "statefulsets" - verbs: - - "list" -- apiGroups: - - "autoscaling" - resources: - - "horizontalpodautoscalers" - verbs: - - "list" -- apiGroups: - - "networking.k8s.io" - resources: - - "networkpolicies" - verbs: - - "get" - - "list" - - "watch" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cis-operator-role - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - namespace: {{ template "cis.namespace" . }} -rules: -- apiGroups: - - "" - resources: - - "services" - verbs: - - "watch" - - "list" - - "get" - - "patch" -- apiGroups: - - "batch" - resources: - - "jobs" - verbs: - - "watch" - - "list" - - "get" - - "delete" -- apiGroups: - - "" - resources: - - "configmaps" - - "pods" - - "secrets" - verbs: - - "*" -- apiGroups: - - "apps" - resources: - - "daemonsets" - verbs: - - "*" -- apiGroups: - - monitoring.coreos.com - resources: - - prometheusrules - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-operator-clusterrolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cis-operator-clusterrole -subjects: -- kind: ServiceAccount - name: cis-operator-serviceaccount - namespace: {{ template "cis.namespace" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cis-scan-ns - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cis-scan-ns -subjects: -- kind: ServiceAccount - name: cis-serviceaccount - namespace: {{ template "cis.namespace" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-operator-rolebinding - namespace: {{ template "cis.namespace" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cis-operator-role -subjects: -- kind: ServiceAccount - name: cis-serviceaccount - namespace: {{ template "cis.namespace" . }} -- kind: ServiceAccount - name: cis-operator-serviceaccount - namespace: {{ template "cis.namespace" . }} diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-cis-1.8.yaml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-cis-1.8.yaml deleted file mode 100644 index 40be06c94..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-cis-1.8.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: cis-1.8-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: cis-1.8 diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-hardened.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-hardened.yml deleted file mode 100644 index 03f669568..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.8-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.8-hardened diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-permissive.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-permissive.yml deleted file mode 100644 index 39932a4e5..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-k3s-cis-1.8-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.8-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.8-permissive diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-hardened.yaml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-hardened.yaml deleted file mode 100644 index 54aa08691..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-hardened.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-hardened-1.8 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.8-hardened diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-permissive.yaml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-permissive.yaml deleted file mode 100644 index f7d4fdd22..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke-1.8-permissive.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-permissive-1.8 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.8-permissive diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-hardened.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-hardened.yml deleted file mode 100644 index d0a1180f5..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.8-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.8-hardened diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-permissive.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-permissive.yml deleted file mode 100644 index 0aa72407c..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofile-rke2-cis-1.8-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.8-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.8-permissive diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofileaks.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofileaks.yml deleted file mode 100644 index ac9f47a8f..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofileaks.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: aks-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: aks-1.0 diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofileeks.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofileeks.yml deleted file mode 100644 index 7cf7936cb..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofileeks.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: eks-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: eks-1.2.0 diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofilegke-1.6.0.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofilegke-1.6.0.yml deleted file mode 100644 index 1fc299fc5..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofilegke-1.6.0.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: gke-profile-1.6.0 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: gke-1.6.0 diff --git a/packages/rancher-cis-benchmark/charts/templates/scanprofilegke.yml b/packages/rancher-cis-benchmark/charts/templates/scanprofilegke.yml deleted file mode 100644 index 42fa4f23a..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/scanprofilegke.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: gke-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: gke-1.2.0 diff --git a/packages/rancher-cis-benchmark/charts/templates/serviceaccount.yaml b/packages/rancher-cis-benchmark/charts/templates/serviceaccount.yaml deleted file mode 100644 index ec48ec622..000000000 --- a/packages/rancher-cis-benchmark/charts/templates/serviceaccount.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: {{ template "cis.namespace" . }} - name: cis-operator-serviceaccount ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: {{ template "cis.namespace" . }} - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-serviceaccount diff --git a/packages/rancher-cis-benchmark/charts/values.yaml b/packages/rancher-cis-benchmark/charts/values.yaml deleted file mode 100644 index 47df6e468..000000000 --- a/packages/rancher-cis-benchmark/charts/values.yaml +++ /dev/null @@ -1,53 +0,0 @@ -# Default values for rancher-cis-benchmark. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -image: - cisoperator: - repository: rancher/cis-operator - tag: v1.3.0-rc.1 - securityScan: - repository: rancher/security-scan - tag: v0.5.0-rc.1 - sonobuoy: - repository: rancher/mirrored-sonobuoy-sonobuoy - tag: v0.57.2 - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} - -## List of node taints to tolerate (requires Kubernetes >= 1.6) -tolerations: [] - -securityScanJob: - overrideTolerations: false - tolerations: [] - -affinity: {} - -global: - cattle: - systemDefaultRegistry: "" - clusterName: "" - kubectl: - repository: rancher/kubectl - tag: v1.30.5 - -alerts: - enabled: false - severity: warning - metricsPort: 8080 diff --git a/packages/rancher-cis-benchmark/charts/crds/clusterscan.yaml b/packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscan.yaml old mode 100755 new mode 100644 similarity index 100% rename from packages/rancher-cis-benchmark/charts/crds/clusterscan.yaml rename to packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscan.yaml diff --git a/packages/rancher-cis-benchmark/charts/crds/clusterscanbenchmark.yaml b/packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscanbenchmark.yaml old mode 100755 new mode 100644 similarity index 100% rename from packages/rancher-cis-benchmark/charts/crds/clusterscanbenchmark.yaml rename to packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscanbenchmark.yaml diff --git a/packages/rancher-cis-benchmark/charts/crds/clusterscanprofile.yaml b/packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscanprofile.yaml old mode 100755 new mode 100644 similarity index 100% rename from packages/rancher-cis-benchmark/charts/crds/clusterscanprofile.yaml rename to packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscanprofile.yaml diff --git a/packages/rancher-cis-benchmark/charts/crds/clusterscanreport.yaml b/packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscanreport.yaml old mode 100755 new mode 100644 similarity index 100% rename from packages/rancher-cis-benchmark/charts/crds/clusterscanreport.yaml rename to packages/rancher-cis-benchmark/generated-changes/overlay/crds/clusterscanreport.yaml diff --git a/packages/rancher-cis-benchmark/package.yaml b/packages/rancher-cis-benchmark/package.yaml index e09bc73f2..0e8d33e66 100644 --- a/packages/rancher-cis-benchmark/package.yaml +++ b/packages/rancher-cis-benchmark/package.yaml @@ -1,8 +1,14 @@ -url: local -version: 7.0.0-rc.2 +auto: true +url: https://github.com/rancher/cis-operator.git +chartRepoBranch: release/v1.3 +subdirectory: chart additionalCharts: - workingDir: charts-crd + upstreamOptions: + url: https://github.com/rancher/cis-operator.git + chartRepoBranch: release/v1.3 + subdirectory: crds crdOptions: templateDirectory: crd-template crdDirectory: templates - addCRDValidationToMainChart: true + addCRDValidationToMainChart: true \ No newline at end of file diff --git a/release.yaml b/release.yaml index e24328df3..0feb8989a 100644 --- a/release.yaml +++ b/release.yaml @@ -22,6 +22,10 @@ rancher-backup: - 105.0.0+up6.0.0 rancher-backup-crd: - 105.0.0+up6.0.0 +rancher-cis-benchmark: + - 105.0.0+up7.0.0 +rancher-cis-benchmark-crd: + - 105.0.0+up7.0.0 rancher-csp-adapter: - 105.0.0+up5.0.1-rc1 rancher-eks-operator: @@ -32,6 +36,14 @@ rancher-gke-operator: - 105.0.0+up1.10.0 rancher-gke-operator-crd: - 105.0.0+up1.10.0 +rancher-istio: + - 104.4.1+up1.22.1 + - 104.5.0+up1.23.2 + - 105.0.0+up1.19.6 + - 105.1.0+up1.20.3 + - 105.2.0+up1.21.1 + - 105.3.0+up1.22.1 + - 105.4.0+up1.23.2 rancher-logging: - 105.0.0+up4.8.0 rancher-logging-crd: @@ -55,11 +67,3 @@ rancher-webhook: - 2.0.13+up0.3.13 system-upgrade-controller: - 105.0.0 -rancher-istio: - - 104.4.1+up1.22.1 - - 104.5.0+up1.23.2 - - 105.0.0+up1.19.6 - - 105.1.0+up1.20.3 - - 105.2.0+up1.21.1 - - 105.3.0+up1.22.1 - - 105.4.0+up1.23.2 diff --git a/scripts/version b/scripts/version index f75b46ae1..851af5f8c 100755 --- a/scripts/version +++ b/scripts/version @@ -2,4 +2,4 @@ set -e CHARTS_BUILD_SCRIPTS_REPO=https://github.com/rancher/charts-build-scripts.git -CHARTS_BUILD_SCRIPT_VERSION="${CHARTS_BUILD_SCRIPT_VERSION:-v1.0.0}" +CHARTS_BUILD_SCRIPT_VERSION="${CHARTS_BUILD_SCRIPT_VERSION:-v1.1.0}"