From 3e596d562f77180e8de2e981209ba58637d1576d Mon Sep 17 00:00:00 2001 From: Rayan Das Date: Tue, 16 Aug 2022 11:02:17 +0530 Subject: [PATCH 1/3] bump cis-benchmark version to 2.1.0-rc1 --- packages/rancher-cis-benchmark/charts/Chart.yaml | 4 ++-- packages/rancher-cis-benchmark/package.yaml | 2 +- release.yaml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/rancher-cis-benchmark/charts/Chart.yaml b/packages/rancher-cis-benchmark/charts/Chart.yaml index f5035226d..49d7dd1de 100644 --- a/packages/rancher-cis-benchmark/charts/Chart.yaml +++ b/packages/rancher-cis-benchmark/charts/Chart.yaml @@ -12,11 +12,11 @@ annotations: catalog.cattle.io/type: cluster-tool catalog.cattle.io/ui-component: rancher-cis-benchmark apiVersion: v1 -appVersion: v2.0.5-rc6 +appVersion: v2.1.0-rc1 description: The cis-operator enables running CIS benchmark security scans on a kubernetes cluster icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg keywords: - security name: rancher-cis-benchmark -version: 2.0.5-rc6 +version: 2.1.0-rc1 diff --git a/packages/rancher-cis-benchmark/package.yaml b/packages/rancher-cis-benchmark/package.yaml index 9a06a90ea..6568c6d22 100644 --- a/packages/rancher-cis-benchmark/package.yaml +++ b/packages/rancher-cis-benchmark/package.yaml @@ -1,5 +1,5 @@ url: local -version: 2.0.5-rc6 +version: 2.1.0-rc1 additionalCharts: - workingDir: charts-crd crdOptions: diff --git a/release.yaml b/release.yaml index c8ba6f142..bac533994 100644 --- a/release.yaml +++ b/release.yaml @@ -23,10 +23,10 @@ rancher-backup-crd: - 2.1.3 rancher-cis-benchmark: - 1.0.700 -- 2.0.5-rc6 +- 2.1.0-rc1 rancher-cis-benchmark-crd: - 1.0.700 -- 2.0.5-rc6 +- 2.1.0-rc1 rancher-csp-adapter: - 1.0.0+up1.0.0-rc8 rancher-eks-operator: From 89de042d5cd061b3a81de7472e35e1dad079708c Mon Sep 17 00:00:00 2001 From: Rayan Das Date: Tue, 16 Aug 2022 11:03:05 +0530 Subject: [PATCH 2/3] remove old rc version --- .../rancher-cis-benchmark-crd-2.0.5-rc6.tgz | Bin 1465 -> 0 bytes .../rancher-cis-benchmark-2.0.5-rc6.tgz | Bin 6161 -> 0 bytes .../2.0.5-rc6/Chart.yaml | 10 -- .../2.0.5-rc6/README.md | 2 - .../2.0.5-rc6/templates/clusterscan.yaml | 148 ------------------ .../templates/clusterscanbenchmark.yaml | 54 ------- .../templates/clusterscanprofile.yaml | 36 ----- .../templates/clusterscanreport.yaml | 39 ----- .../2.0.5-rc6/Chart.yaml | 22 --- .../rancher-cis-benchmark/2.0.5-rc6/README.md | 9 -- .../2.0.5-rc6/app-readme.md | 15 -- .../2.0.5-rc6/templates/_helpers.tpl | 27 ---- .../2.0.5-rc6/templates/alertingrule.yaml | 14 -- .../templates/benchmark-aks-1.0.yaml | 8 - .../templates/benchmark-cis-1.20.yaml | 8 - .../templates/benchmark-cis-1.23.yaml | 8 - .../templates/benchmark-cis-1.5.yaml | 8 - .../templates/benchmark-cis-1.6.yaml | 8 - .../templates/benchmark-eks-1.0.1.yaml | 8 - .../templates/benchmark-gke-1.0.yaml | 8 - .../benchmark-k3s-cis-1.20-hardened.yaml | 8 - .../benchmark-k3s-cis-1.20-permissive.yaml | 8 - .../benchmark-k3s-cis-1.23-hardened.yaml | 8 - .../benchmark-k3s-cis-1.23-permissive.yaml | 8 - .../benchmark-k3s-cis-1.6-hardened.yaml | 8 - .../benchmark-k3s-cis-1.6-permissive.yaml | 8 - .../benchmark-rke-cis-1.20-hardened.yaml | 8 - .../benchmark-rke-cis-1.20-permissive.yaml | 8 - .../benchmark-rke-cis-1.23-hardened.yaml | 8 - .../benchmark-rke-cis-1.23-permissive.yaml | 8 - .../benchmark-rke-cis-1.5-hardened.yaml | 8 - .../benchmark-rke-cis-1.5-permissive.yaml | 8 - .../benchmark-rke-cis-1.6-hardened.yaml | 8 - .../benchmark-rke-cis-1.6-permissive.yaml | 8 - .../benchmark-rke2-cis-1.20-hardened.yaml | 8 - .../benchmark-rke2-cis-1.20-permissive.yaml | 8 - .../benchmark-rke2-cis-1.23-hardened.yaml | 8 - .../benchmark-rke2-cis-1.23-permissive.yaml | 8 - .../benchmark-rke2-cis-1.5-hardened.yaml | 8 - .../benchmark-rke2-cis-1.5-permissive.yaml | 8 - .../benchmark-rke2-cis-1.6-hardened.yaml | 8 - .../benchmark-rke2-cis-1.6-permissive.yaml | 8 - .../2.0.5-rc6/templates/cis-roles.yaml | 49 ------ .../2.0.5-rc6/templates/configmap.yaml | 18 --- .../2.0.5-rc6/templates/deployment.yaml | 55 ------- .../templates/network_policy_allow_all.yaml | 15 -- .../patch_default_serviceaccount.yaml | 29 ---- .../2.0.5-rc6/templates/rbac.yaml | 43 ----- .../templates/scanprofile-cis-1.20.yaml | 9 -- .../templates/scanprofile-cis-1.23.yaml | 9 -- .../templates/scanprofile-cis-1.5.yml | 9 -- .../templates/scanprofile-cis-1.6.yaml | 9 -- .../scanprofile-k3s-cis-1.20-hardened.yml | 9 -- .../scanprofile-k3s-cis-1.20-permissive.yml | 9 -- .../scanprofile-k3s-cis-1.23-hardened.yml | 9 -- .../scanprofile-k3s-cis-1.23-permissive.yml | 9 -- .../scanprofile-k3s-cis-1.6-hardened.yml | 9 -- .../scanprofile-k3s-cis-1.6-permissive.yml | 9 -- .../scanprofile-rke-1.20-hardened.yaml | 9 -- .../scanprofile-rke-1.20-permissive.yaml | 9 -- .../scanprofile-rke-1.23-hardened.yaml | 9 -- .../scanprofile-rke-1.23-permissive.yaml | 9 -- .../scanprofile-rke-1.5-hardened.yml | 9 -- .../scanprofile-rke-1.5-permissive.yml | 9 -- .../scanprofile-rke-1.6-hardened.yaml | 9 -- .../scanprofile-rke-1.6-permissive.yaml | 9 -- .../scanprofile-rke2-cis-1.20-hardened.yml | 9 -- .../scanprofile-rke2-cis-1.20-permissive.yml | 9 -- .../scanprofile-rke2-cis-1.23-hardened.yml | 9 -- .../scanprofile-rke2-cis-1.23-permissive.yml | 9 -- .../scanprofile-rke2-cis-1.5-hardened.yml | 9 -- .../scanprofile-rke2-cis-1.5-permissive.yml | 9 -- .../scanprofile-rke2-cis-1.6-hardened.yml | 9 -- .../scanprofile-rke2-cis-1.6-permissive.yml | 9 -- .../2.0.5-rc6/templates/scanprofileaks.yml | 9 -- .../2.0.5-rc6/templates/scanprofileeks.yml | 9 -- .../2.0.5-rc6/templates/scanprofilegke.yml | 9 -- .../2.0.5-rc6/templates/serviceaccount.yaml | 14 -- .../templates/validate-install-crd.yaml | 17 -- .../2.0.5-rc6/values.yaml | 49 ------ index.yaml | 40 ----- 81 files changed, 1198 deletions(-) delete mode 100644 assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.0.5-rc6.tgz delete mode 100644 assets/rancher-cis-benchmark/rancher-cis-benchmark-2.0.5-rc6.tgz delete mode 100644 charts/rancher-cis-benchmark-crd/2.0.5-rc6/Chart.yaml delete mode 100644 charts/rancher-cis-benchmark-crd/2.0.5-rc6/README.md delete mode 100644 charts/rancher-cis-benchmark-crd/2.0.5-rc6/templates/clusterscan.yaml delete mode 100644 charts/rancher-cis-benchmark-crd/2.0.5-rc6/templates/clusterscanbenchmark.yaml delete mode 100644 charts/rancher-cis-benchmark-crd/2.0.5-rc6/templates/clusterscanprofile.yaml delete mode 100644 charts/rancher-cis-benchmark-crd/2.0.5-rc6/templates/clusterscanreport.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/Chart.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/README.md delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/app-readme.md delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/_helpers.tpl delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/alertingrule.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-aks-1.0.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.20.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.23.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.5.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.6.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-eks-1.0.1.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-gke-1.0.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/cis-roles.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/configmap.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/deployment.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/network_policy_allow_all.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/patch_default_serviceaccount.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/rbac.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.20.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.23.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.5.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.6.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-hardened.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-permissive.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-hardened.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-permissive.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileaks.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileeks.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofilegke.yml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/serviceaccount.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/templates/validate-install-crd.yaml delete mode 100644 charts/rancher-cis-benchmark/2.0.5-rc6/values.yaml diff --git a/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.0.5-rc6.tgz b/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.0.5-rc6.tgz deleted file mode 100644 index 7311de0fd6eb00fbded5578fb2489a01d30226ff..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1465 zcmV;q1xETGiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI>(bK*7-&NIJ4bA85V6W}_$<+y9-+FmY0((CggZ$KAY@<{76 zOsD_7BijkKu`vciu5;`QgCu_|+24LEt*t@wCF(vGrawo?mm%nfKG*)+=@K+KD+q&& z1I=|^cRU;>zpm?+f8Ehwc;O8P<3JFog~Nd;Ku4&z95so1f&PSLT&Wzk6uysg!rqXM@lE9r2_c#YI8K;l zn~G2aDcv_KLl{^h!y(UMrig3apiUPrtyViSr_B(J~XVlkx+I9AT)1z5F0{m zILN*9V0-*~?!fbk@jvh`NAJ$@e+tV-4nzW<2&MgJoQI!{4Z%mR_aLM{Vbj=<3TJ3k ztT}$bdm%*<0U;9jKw$MFjh`H0jKhUlM|96b$nC&|R&kUFL9R2sJ`p0uGOsDrEeDyj zMnSA0D7xq|X1KC}nT_r-mW5@4)z7B&=p_&a^`n(Dt5j(NDGdwEwSey@YlGlM3rVP_ zDu_dw&8*M986|IkmJ{X}0*Z|jfT39|?L2R^x)%XnLzsd+-<8}_vLRV_Dk_Gwkc(Oe zCJsZ;D~A+8P{6&*wX}kYz?cHk&AOo#&^?Ialzv$^v;r~@A}Rpgt{Ykb{S8_cfc{!H zv;vZfu2Qw12gS#Et%z-O?S!3i{0$CvGkO6sr0g;Tu+9O(UVSnl)9i zq-rlIgcYgER@U)#y6D?GPu8A)WgBGxCA(_`X6k z#_ocS>O>Gr(Scna_;b) zXqj*{aC*^!O4(ht4|YM%42yC+9kG{r$?+`QKC+&B%A2lwj$ZyyJMQ##Jb>7^}ox($UWEpPGQHc|Gf~V!$RQuXUwF#q9V9<`nsjT2)UC@>qe_b;lD^`p(0r7 z+o9AG3i*3HM=g=iWY4dF{JDO>F7WWw0AD{~2Y8+^>E$V=C6~_-ZB$Hm7uOnvbe*27x7?po`AOd*cId2%@SWmUgkyL3hitA|=Km-?jkJ3W*pUCd(crR_ z|C24jIsc!)j-CHA!gQGZ^Y6|oa{sf#?lb@QB=9exdIYhuC(b)G)TVISSWekmOxd%b z)vSALj}2S-))saL@2fitt9$K`Ze=a?Ut^?Ne-+lG|Kri9tpDS|`TLKP*s=9LB}|9% zKT81X)IW3g`p3Q_z2iSvoY)VP$c|a#PKoy0?U(Bl?&FUT|MmJm`*`)?^G7H25BAaY z{jWD1l)nER4KL62zmwQcTRwKZVzac5@g-#>C@OnXS9~)=!xk6eN=7I*Zn{SH zy5@Cr@8|uy{eHjqpYQQFuXE1(@jlP@5q-wONAqt0S(=Nkrq>nSOf6L{qBO4DQ*lsq zx4UxR*-k^%+QC89@}{4UYk+%{y)8n=)Wgr8W+P@j6Q|k~0Ey`IU5K)pvbs`r>)K0O z%kpYBV!^H;E-37Qa?b95(_F1mu12&cX_`uBcG@?*rmUMz%wGLodv06;_iDDr{;hO( z;(D_@jVVjdCs{U3*|?ziUU`UwXDz>-M0UH>-fR(X$xJ{q^YZc%KD@nygz);d6+5A^ z&A~*mLaV8R@|jg)^bDdTCS{0IJTv7fVjA@l>$%v;!`0s+krFKZgq6&i#fi zR2Gq88uUcD%9QJ*>vCX__8by+ez0gOd-k>}V z&w|*~FTS-JipzQ#M*hWazg`H}3c%g}4BsE^gh-*wWtt}hc{rbxT!FpL;f!<8>Y2W%cPdUsXVXRvN7Ace=FLoz z=GS7e_tO<`Q>Maj0eJ4;C39u_4D30rP;82?4&%Upj2^4Rz2_g21?8PM#KxX6+_NnwrZ{;ah7zD<5W=RjnzD?fX{PoP(u;fn$ z!G>cFvZJ46CG(1Ba@IwBR&^pA3`ke5tvG9+`GsoMvJlNEh^t<@8EuZhl zDZhMt1XBNNg<%C1_ifB2a=pqSy5(QrMY^9Ey?dM?R_@==#;ASg%7L94clGezH!>5U z$D8G4_=8tu9Zc)$q!qDU?Q+$8J@=p+%3C{%4$+#%mCntilxVO;pOI;0A-TqfRli$M zm~%zBj+5wqjhLa5T$v`<9}_CYv~qtB>!Tet{w*(H=#=~r&A0^It|~4~AJ1^La!amH ze@AbEey*U7`IOAuwo|OjnK#{g#+ieWv4pui<44ai*|v?(`>g47CG_Wct7+U$_ljIE zRjvy%cr(8F&9AUM*(t{NWJzoJ`f8O6EHRV8*J!J0hMHnJz97!t{@L_=PGuYQ}Cd?edCPr#;vP|M^tJUusE(Xd#>tUm68=&uM zgv%!KYzrC@bK<6jF`f8{XAQ}D0=`~mODu(muYG)sJ;0#Gqq5^ zfBBQP?~0V<$s>u@;)yxu9fg*B#^NI$Z4pLISyMzxEMLiv;P>onL)ZNL4$50s1?aPR zMX+Du1${hFX(^4FYOfX)qa5H}I|4da9xvUB&H7WX;MIBda((Oz({I1<*w%Xky=#3Q zj%vj|f7^pi5b`RLnXd3BiO+IA~9;{w>@h+jzF3hyCXZj?-EOv|QOM*6Xp#Kl&W z#g`ep*VtTcSkT-=MN+CvQa`%|*>ypukaYmtPoJjH_4m88@0(avgMsv8#J%mE6p}bL zpdoiw&%4+xZLqg>s9^}1nyJwXen=@4n3*t7_2qPlLlJ5ebU?*}u_kgoebL6<3XA?V z{`Y0U3*1eGIryarWn<+eX=u1TvgcMlgQi27->Gy@CpE2ritVN%Ap8CAg+Of(#>QL3 z??7|z2)~Xa;hh7Wp$a#5G@ar{gJTl#`U;|L^Fc@95x$vfB8Py!nG0r87m*z@gCO=C zghb!~?BB`_0vbL|zC}a_@GXK8dFa+L{6zIED7g%nbHSB`NXShYU}fLZa_k}BeF1x~ z7Lju5a^R!V2RMDnOImU!Rmgdjw?PonWf}N(-zTA-XHYg!L*G7tYdt$;)PZ{w)2u}@ zA>%bNTUC7k?7bi&+dA~IyXe!!xj+ju5bLkFuCsCC=a0BS+f1;OcwTmOMyV))YHk8T zMLY-xUUHS`phoH5l`j5g*U8&IT)=}|5LTiL5q0qp?nl=e^;ixL>`{F?OWk??9dMwx zf1ykkGB1Y`(6)*}Npk#dzO;1O>=Xu>uBsTWv0f)9{IyTR}Q*c<7Z2F^BTfwe1C z%Ty_Z*@F+g>m-3^P5*Vekk!L`VvhlmYBbsdvF*^!D}%e};9~?H)HB}L{XaWCwkd#7 zjfM{e*6%cILU?BzL6G)~hVX6=ygY~OqXvg}8>}O?!N)yhV~GKTlKSU}bM`#4o1MmE z1BvMejnu@6w$jeJF5{^&ykfqKjy^^#P~$HSta+eY>^5>7J8(F^ww}`=0soo29X?&O z2R2jhfO_U4GQZ?}tJHNn`4wcrXY|ZeL~x#b%M$ID2HoSMkU=2{Hbo87yvO^91QXYA z<@%3x-a|LyGfjFvKP*+hxXPW&Zq>RTAaj(@)Ux+`SID%tjvgsX0`t z%`pu^W$e9x*5={TUwAw2;|@~JG_+xLQBCT$-B!fQvurqwQZn7*hC{{G)E(Z5kOgIgXW|Yj=6n30lKQU{_+R8H|r=6Q*1%D}X*&U9N z5f%Gnj*8lf=8ppkPq)ldRWu$;kGMzQs##2~a|-!zp`_E)!u-Rl;K>PoEbLQT&I_yj z&|lv|`<)GhT_{08rr=nB>7j;6`JnJW-ia8)r+|@7qUgH*UA!*{S!_lRMaQP$M*bn7 zt<5GqgZpFs`GC4nwKo!K%BB@*)cU%LTN-N(H-s;{pOt0*Kqnm>+&IB9X(S@YCni@; zdNH3G9l08%eQ#~kp-jV!j_17T*Uq?E1-BEI62B3k^`xkVAGE|C zK+Cuy{yYQ%-qA|N-H@-*l8bN~I_(QfzAIJf?1S>?piPq<+&un@-n=wIU(jobmZM;r zVGtor6j@iATD)W1oA+d`*&)HLCU@|+T`hloK!5@qeg}C zxo@_p)L=nN6f!L4_;7bPb!$WoBQ-0@^PlFWpz=m@XWyLKD4G|?519Et!O$ZM=Uk3h zX5)f13;l}r3*rm9zyC{dzL~46@buwhPd%soqOxtRDru}_z_}$YxvO4g7^m>4pqdoyZGTxZ@K@dojy(N5qHOJMh z9jSV)%{=4Jhp&+6E)b|@IOMUe0>@lRKAH+<^~AcP|Sn^Qzv$*_33biV(-Wjgk(^n=u*zZbUz30UK)dgG+PL z2pS6})g8+5cYN zbXt?szMl5o4E9*~u5lT%til3^8Lhol(`eF6ek-x_daI;kGd6To=TmM*bhS*%4L|gG zr~i^#Q=>~x%=>qggM_nC!Yy=-eT+zUhGi4iCg?ny@Uyr@j zTSo|dfP32hYEh;%zSNJ!@|=X9=hz)p^}VYvBEq!8g=2?hy1`vJa`QG4o4|I2ugL>C zU%{we5Ja5u==LTk0<}@(+WscV`e1gSyp1&nogTpJwK`x{7A(VPC{uXk#z9jjnA~!LunBg%NdJfbJ(50VGisc6S^nA3HYaAj2Lp^x zN6C;IVx5fL+Y1r?SMo{d!#X>EA+fx5w`M}#i%jzN4S%pnLL8JxKtz!-i1?NQ6L~{| zzo%^D_E0|hi)7@h&f7E961(1o^yP#qLW*%BukEsx#H6>LWB|v2prxTqDG2lK}cSke7U^O6wa-IF9i(X_W9Sw3zu0 zn&TKjf}dD>4;p=Fe8Gtlb#R=x1feyOz|8PAdcTdn9n_!x?gEY*GmuvCUZrtApa3SqUjrzx<;5~gEVyf2;WS&quN;`Q<35lTcIjMX|Ite=` z*+f&puJRQ~y9YMq<0Ps0n5as7<`uxb2bh0Rrshm^j7+RO_}`pu9s|l<{4Scqegt3? zK{$Wc7?pDjL}_F^z(37b$@LU^8ZAuuBBY{oqx2HJ&h7UqBf!$hR!%aC>It+Lw{^<9AV zlOwd!W*)+I*a%2vt=$-uW%he;NUo0#G>5Dmj*%CaK<|bT@DU=N=+}qpUwS!jNv#-? zw-L1*`>o*r!zz)@MZX5$M-(eLBpCyZXKG|Y0TMJJDpMnUf5?$MT zk>?wc^D9K?`k7f|1$Nt?fUdbi_Z0{c{y@KJHItGPyl9mpPY3EgGw{|8eHzYN*qT*U z^zA#)L2~#9>c;qJ)5`5xyNM`?CgC4h>*TbH+rCjND*A1FaoOv#s|8*1xmRTIvzW!J zQdU+`v{-@Q*G(w?$Cg~b_@$&Ig>0_cw&iW#J@?mo>H4^mMKW1SeuDf;HnxnxgEtU$ zeia%u&X~;fK7ZjnX91d6-(rt!(|H7&L)c%aI+n|5btv^Z^3CnF_pg8%v*gy6XBbQ`D*JUHIcu40qu8Uw?{q!J+Oq07qRsQ? z*|&GM(lF)I{K?d2&)>D(#iEN5v4z{-XLi9zyYM>tMq=pQ-T6uwxRpEy{;qkRLd6>?@Yu`gGe_~L)6-qtmVH4JuP7=#&|qo_ zMG4q!+QuuI+a(n8Fp9V;8W2bc)Iah{`-^_w$W!ZdZs|fV(nMjZ5%gZ z|5jBEo1%>ohDhC1_DF*b)1t_ulB+ro;w|7pA++`T3Q24MJhY=XH4UL%ziNA#C$*FJ z-UsRwdd>$c-LFmhWB#Jy6;%{ipj&z$qPTP~U_X9R&90NCPdw9`P1U$mBHl|Z@VNng zE+dXpml#ZvJ`<>;i&)iKO`N=grPL#);#j}Q9x;auhwD~ zTryKNz&GbmLuTZW<8sPVGchsAY8zthmTBVj)WVQ`T9D|Q&X3MWd`KY7}2&9c!kCdy-fYdl@z^&{1`$8!2fD`QFrnW;C< z{CS?F=Tsab-IaL9t+-2ozb#UVjc=oxHZsHhAqU;Lw8s@%an-W#)KOd%^@WCCmcZNhxk{lsc?XjYwe_Kg9CJlv1p6GKxA?LyHrd1j2Vb@wwWn@;)1nL4^~ ztsoCRdzQMF)f-3*oH@l-5Q>cm= 1.21.0-0 < 1.25.0-0' - catalog.cattle.io/namespace: cis-operator-system - catalog.cattle.io/os: linux - catalog.cattle.io/permits-os: linux,windows - catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 - catalog.cattle.io/rancher-version: '>= 2.6.0-0 < 2.7.0-0' - catalog.cattle.io/release-name: rancher-cis-benchmark - catalog.cattle.io/type: cluster-tool - catalog.cattle.io/ui-component: rancher-cis-benchmark -apiVersion: v1 -appVersion: v2.0.5-rc6 -description: The cis-operator enables running CIS benchmark security scans on a kubernetes - cluster -icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg -keywords: -- security -name: rancher-cis-benchmark -version: 2.0.5-rc6 diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/README.md b/charts/rancher-cis-benchmark/2.0.5-rc6/README.md deleted file mode 100644 index 50beab58b..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/README.md +++ /dev/null @@ -1,9 +0,0 @@ -# Rancher CIS Benchmark Chart - -The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded. - -# Installation - -``` -helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system -``` diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/app-readme.md b/charts/rancher-cis-benchmark/2.0.5-rc6/app-readme.md deleted file mode 100644 index 5e495d605..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/app-readme.md +++ /dev/null @@ -1,15 +0,0 @@ -# Rancher CIS Benchmarks - -This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/). - -For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/). - -This chart installs the following components: - -- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded. -- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed. -- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans. -- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources. -- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish. - - If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts. - - Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart. diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/_helpers.tpl b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/_helpers.tpl deleted file mode 100644 index b7bb00042..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/_helpers.tpl +++ /dev/null @@ -1,27 +0,0 @@ -{{/* Ensure namespace is set the same everywhere */}} -{{- define "cis.namespace" -}} - {{- .Release.Namespace | default "cis-operator-system" -}} -{{- end -}} - -{{- define "system_default_registry" -}} -{{- if .Values.global.cattle.systemDefaultRegistry -}} -{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} -{{- else -}} -{{- "" -}} -{{- end -}} -{{- end -}} - -{{/* -Windows cluster will add default taint for linux nodes, -add below linux tolerations to workloads could be scheduled to those linux nodes -*/}} -{{- define "linux-node-tolerations" -}} -- key: "cattle.io/os" - value: "linux" - effect: "NoSchedule" - operator: "Equal" -{{- end -}} - -{{- define "linux-node-selector" -}} -kubernetes.io/os: linux -{{- end -}} diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/alertingrule.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/alertingrule.yaml deleted file mode 100644 index 1787c88a0..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/alertingrule.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.alerts.enabled -}} ---- -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: rancher-cis-pod-monitor - namespace: {{ template "cis.namespace" . }} -spec: - selector: - matchLabels: - cis.cattle.io/operator: cis-operator - podMetricsEndpoints: - - port: cismetrics -{{- end }} diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-aks-1.0.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-aks-1.0.yaml deleted file mode 100644 index 1ac866253..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-aks-1.0.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: aks-1.0 -spec: - clusterProvider: aks - minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.20.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.20.yaml deleted file mode 100644 index 898976581..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.20.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: cis-1.20 -spec: - clusterProvider: "" - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.23.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.23.yaml deleted file mode 100644 index a4c6d1ff2..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.23.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: cis-1.23 -spec: - clusterProvider: "" - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.5.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.5.yaml deleted file mode 100644 index 39e8b834a..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.5.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: cis-1.5 -spec: - clusterProvider: "" - minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.6.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.6.yaml deleted file mode 100644 index 93ba064f4..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-cis-1.6.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: cis-1.6 -spec: - clusterProvider: "" - minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-eks-1.0.1.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-eks-1.0.1.yaml deleted file mode 100644 index d1ba9d295..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-eks-1.0.1.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: eks-1.0.1 -spec: - clusterProvider: eks - minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-gke-1.0.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-gke-1.0.yaml deleted file mode 100644 index 72122e8c5..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-gke-1.0.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: gke-1.0 -spec: - clusterProvider: gke - minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-hardened.yaml deleted file mode 100644 index 872bb9b3b..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.20-hardened -spec: - clusterProvider: k3s - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-permissive.yaml deleted file mode 100644 index 58ec00f23..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.20-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.20-permissive -spec: - clusterProvider: k3s - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-hardened.yaml deleted file mode 100644 index bd6ce6188..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.23-hardened -spec: - clusterProvider: k3s - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-permissive.yaml deleted file mode 100644 index dd6dee3bb..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.23-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.23-permissive -spec: - clusterProvider: k3s - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-hardened.yaml deleted file mode 100644 index 3ca9b6009..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.6-hardened -spec: - clusterProvider: k3s - minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-permissive.yaml deleted file mode 100644 index 6d4253c6e..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-k3s-cis-1.6-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: k3s-cis-1.6-permissive -spec: - clusterProvider: k3s - minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-hardened.yaml deleted file mode 100644 index 0555922ad..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.20-hardened -spec: - clusterProvider: rke - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-permissive.yaml deleted file mode 100644 index d09e9e1ed..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.20-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.20-permissive -spec: - clusterProvider: rke - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-hardened.yaml deleted file mode 100644 index bc6ad77a6..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.23-hardened -spec: - clusterProvider: rke - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-permissive.yaml deleted file mode 100644 index f63b45590..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.23-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.23-permissive -spec: - clusterProvider: rke - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-hardened.yaml deleted file mode 100644 index b5627f966..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.5-hardened -spec: - clusterProvider: rke - minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-permissive.yaml deleted file mode 100644 index 95f80c0f0..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.5-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.5-permissive -spec: - clusterProvider: rke - minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-hardened.yaml deleted file mode 100644 index d75de8154..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.6-hardened -spec: - clusterProvider: rke - minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-permissive.yaml deleted file mode 100644 index 52428f4a7..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke-cis-1.6-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke-cis-1.6-permissive -spec: - clusterProvider: rke - minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-hardened.yaml deleted file mode 100644 index 95375fbea..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.20-hardened -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-permissive.yaml deleted file mode 100644 index 51da408b9..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.20-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.20-permissive -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-hardened.yaml deleted file mode 100644 index 1e2cb2a3a..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.23-hardened -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-permissive.yaml deleted file mode 100644 index eef970c0e..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.23-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.23-permissive -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-hardened.yaml deleted file mode 100644 index 3d83e9bd8..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.5-hardened -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.18.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-permissive.yaml deleted file mode 100644 index f66aa8f6e..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.5-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.5-permissive -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.18.0" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-hardened.yaml deleted file mode 100644 index 3593bf371..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-hardened.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.6-hardened -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-permissive.yaml deleted file mode 100644 index 522f846ae..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/benchmark-rke2-cis-1.6-permissive.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - name: rke2-cis-1.6-permissive -spec: - clusterProvider: rke2 - minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/cis-roles.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/cis-roles.yaml deleted file mode 100644 index 23c93dc65..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/cis-roles.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cis-admin -rules: - - apiGroups: - - cis.cattle.io - resources: - - clusterscanbenchmarks - - clusterscanprofiles - - clusterscans - - clusterscanreports - verbs: ["create", "update", "delete", "patch","get", "watch", "list"] - - apiGroups: - - catalog.cattle.io - resources: ["apps"] - resourceNames: ["rancher-cis-benchmark"] - verbs: ["get", "watch", "list"] - - apiGroups: - - "" - resources: - - configmaps - verbs: - - '*' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cis-view -rules: - - apiGroups: - - cis.cattle.io - resources: - - clusterscanbenchmarks - - clusterscanprofiles - - clusterscans - - clusterscanreports - verbs: ["get", "watch", "list"] - - apiGroups: - - catalog.cattle.io - resources: ["apps"] - resourceNames: ["rancher-cis-benchmark"] - verbs: ["get", "watch", "list"] - - apiGroups: - - "" - resources: - - configmaps - verbs: ["get", "watch", "list"] diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/configmap.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/configmap.yaml deleted file mode 100644 index 1a9cd1809..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/configmap.yaml +++ /dev/null @@ -1,18 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: default-clusterscanprofiles - namespace: {{ template "cis.namespace" . }} -data: - # Default ClusterScanProfiles per cluster provider type - rke: |- - <1.21.0: rke-profile-permissive-1.20 - >=1.21.0: rke-profile-permissive-1.23 - rke2: |- - <1.21.0: rke2-cis-1.20-profile-permissive - >=1.21.0: rke2-cis-1.23-profile-permissive - eks: "eks-profile" - gke: "gke-profile" - aks: "aks-profile" - k3s: "k3s-cis-1.23-profile-permissive" - default: "cis-1.23-profile" diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/deployment.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/deployment.yaml deleted file mode 100644 index ab0bb3e24..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/deployment.yaml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cis-operator - namespace: {{ template "cis.namespace" . }} - labels: - cis.cattle.io/operator: cis-operator -spec: - selector: - matchLabels: - cis.cattle.io/operator: cis-operator - template: - metadata: - labels: - cis.cattle.io/operator: cis-operator - spec: - serviceAccountName: cis-operator-serviceaccount - containers: - - name: cis-operator - image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}' - imagePullPolicy: Always - ports: - - name: cismetrics - containerPort: {{ .Values.alerts.metricsPort }} - env: - - name: SECURITY_SCAN_IMAGE - value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }} - - name: SECURITY_SCAN_IMAGE_TAG - value: {{ .Values.image.securityScan.tag }} - - name: SONOBUOY_IMAGE - value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }} - - name: SONOBUOY_IMAGE_TAG - value: {{ .Values.image.sonobuoy.tag }} - - name: CIS_ALERTS_METRICS_PORT - value: '{{ .Values.alerts.metricsPort }}' - - name: CIS_ALERTS_SEVERITY - value: {{ .Values.alerts.severity }} - - name: CIS_ALERTS_ENABLED - value: {{ .Values.alerts.enabled | default "false" | quote }} - - name: CLUSTER_NAME - value: '{{ .Values.global.cattle.clusterName }}' - resources: - {{- toYaml .Values.resources | nindent 12 }} - nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} -{{- if .Values.nodeSelector }} -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} - tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} -{{- if .Values.tolerations }} -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/network_policy_allow_all.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/network_policy_allow_all.yaml deleted file mode 100644 index 6ed5d645e..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/network_policy_allow_all.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: default-allow-all - namespace: {{ template "cis.namespace" . }} -spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/patch_default_serviceaccount.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/patch_default_serviceaccount.yaml deleted file mode 100644 index e78a6bd08..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/patch_default_serviceaccount.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: patch-sa - annotations: - "helm.sh/hook": post-install, post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation -spec: - template: - spec: - serviceAccountName: cis-operator-serviceaccount - nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} -{{- if .Values.nodeSelector }} -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} - tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} -{{- if .Values.tolerations }} -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} - restartPolicy: Never - containers: - - name: sa - image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" - imagePullPolicy: {{ .Values.global.imagePullPolicy }} - command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] - args: ["-n", {{ template "cis.namespace" . }}] - - backoffLimit: 1 diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/rbac.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/rbac.yaml deleted file mode 100644 index 4ff88ea5f..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/rbac.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-operator-role -rules: -- apiGroups: - - '*' - resources: - - '*' - verbs: - - '*' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-operator-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cis-operator-role -subjects: -- kind: ServiceAccount - name: cis-serviceaccount - namespace: {{ template "cis.namespace" . }} ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: cis-operator-installer -subjects: -- kind: ServiceAccount - name: cis-operator-serviceaccount - namespace: {{ template "cis.namespace" . }} -roleRef: - kind: ClusterRole - name: cluster-admin - apiGroup: rbac.authorization.k8s.io \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.20.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.20.yaml deleted file mode 100644 index 05263ce7d..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.20.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: cis-1.20-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: cis-1.20 diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.23.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.23.yaml deleted file mode 100644 index c59d8f51f..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.23.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: cis-1.23-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: cis-1.23 diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.5.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.5.yml deleted file mode 100644 index d69ae9dd5..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.5.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: cis-1.5-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: cis-1.5 diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.6.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.6.yaml deleted file mode 100644 index 8a8d8bf88..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-cis-1.6.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: cis-1.6-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: cis-1.6 diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-hardened.yml deleted file mode 100644 index a0b6cb6f6..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.20-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-permissive.yml deleted file mode 100644 index 89885548d..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.20-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.20-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-hardened.yml deleted file mode 100644 index 724412d3a..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.23-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-permissive.yml deleted file mode 100644 index 9f9213de1..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.23-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.23-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-hardened.yml deleted file mode 100644 index 095e977ab..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.6-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-permissive.yml deleted file mode 100644 index 3b22a80c8..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-k3s-cis-1.6-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: k3s-cis-1.6-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: k3s-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-hardened.yaml deleted file mode 100644 index c36cf38c9..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-hardened.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-hardened-1.20 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-permissive.yaml deleted file mode 100644 index cfeb4b34c..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.20-permissive.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-permissive-1.20 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-hardened.yaml deleted file mode 100644 index 007331149..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-hardened.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-hardened-1.23 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-permissive.yaml deleted file mode 100644 index 085b60dfa..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.23-permissive.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-permissive-1.23 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-hardened.yml deleted file mode 100644 index 4eabe158a..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-hardened-1.5 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.5-hardened \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-permissive.yml deleted file mode 100644 index 1f78751d1..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.5-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-permissive-1.5 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.5-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-hardened.yaml deleted file mode 100644 index d38febd80..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-hardened.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-hardened-1.6 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-permissive.yaml deleted file mode 100644 index d31b5b0d2..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke-1.6-permissive.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke-profile-permissive-1.6 - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-hardened.yml deleted file mode 100644 index decc9b651..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.20-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-permissive.yml deleted file mode 100644 index 74c96ffc4..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.20-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.20-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-hardened.yml deleted file mode 100644 index abc1c2a21..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.23-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-permissive.yml deleted file mode 100644 index 51cc519ac..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.23-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.23-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-hardened.yml deleted file mode 100644 index 83eb3131e..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.5-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.5-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-permissive.yml deleted file mode 100644 index 40dc44bdf..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.5-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.5-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.5-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-hardened.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-hardened.yml deleted file mode 100644 index c7ac7f949..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-hardened.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.6-profile-hardened - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-permissive.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-permissive.yml deleted file mode 100644 index 96ca1345a..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofile-rke2-cis-1.6-permissive.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: rke2-cis-1.6-profile-permissive - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: rke2-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileaks.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileaks.yml deleted file mode 100644 index ea7b25b40..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileaks.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: aks-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: aks-1.0 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileeks.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileeks.yml deleted file mode 100644 index 3b4e34437..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofileeks.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: eks-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: eks-1.0.1 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofilegke.yml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofilegke.yml deleted file mode 100644 index 2ddd0686f..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/scanprofilegke.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - name: gke-profile - annotations: - clusterscanprofile.cis.cattle.io/builtin: "true" -spec: - benchmarkVersion: gke-1.0 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/serviceaccount.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/serviceaccount.yaml deleted file mode 100644 index ec48ec622..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/serviceaccount.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: {{ template "cis.namespace" . }} - name: cis-operator-serviceaccount ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: {{ template "cis.namespace" . }} - labels: - app.kubernetes.io/name: rancher-cis-benchmark - app.kubernetes.io/instance: release-name - name: cis-serviceaccount diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/validate-install-crd.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/templates/validate-install-crd.yaml deleted file mode 100644 index 562295791..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/templates/validate-install-crd.yaml +++ /dev/null @@ -1,17 +0,0 @@ -#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} -# {{- $found := dict -}} -# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}} -# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}} -# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}} -# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}} -# {{- range .Capabilities.APIVersions -}} -# {{- if hasKey $found (toString .) -}} -# {{- set $found (toString .) true -}} -# {{- end -}} -# {{- end -}} -# {{- range $_, $exists := $found -}} -# {{- if (eq $exists false) -}} -# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} -# {{- end -}} -# {{- end -}} -#{{- end -}} \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.0.5-rc6/values.yaml b/charts/rancher-cis-benchmark/2.0.5-rc6/values.yaml deleted file mode 100644 index ba1d0d680..000000000 --- a/charts/rancher-cis-benchmark/2.0.5-rc6/values.yaml +++ /dev/null @@ -1,49 +0,0 @@ -# Default values for rancher-cis-benchmark. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -image: - cisoperator: - repository: rancher/cis-operator - tag: v1.0.9 - securityScan: - repository: rancher/security-scan - tag: v0.2.8-rc5 - sonobuoy: - repository: rancher/mirrored-sonobuoy-sonobuoy - tag: v0.56.7 - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} - -## List of node taints to tolerate (requires Kubernetes >= 1.6) -tolerations: [] - -affinity: {} - -global: - cattle: - systemDefaultRegistry: "" - clusterName: "" - kubectl: - repository: rancher/kubectl - tag: v1.20.2 - -alerts: - enabled: false - severity: warning - metricsPort: 8080 diff --git a/index.yaml b/index.yaml index 2a8ee15f5..38888857d 100755 --- a/index.yaml +++ b/index.yaml @@ -2916,32 +2916,6 @@ entries: - assets/rancher-backup-crd/rancher-backup-crd-1.0.200.tgz version: 1.0.200 rancher-cis-benchmark: - - annotations: - catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match - catalog.cattle.io/certified: rancher - catalog.cattle.io/display-name: CIS Benchmark - catalog.cattle.io/kube-version: '>= 1.21.0-0 < 1.25.0-0' - catalog.cattle.io/namespace: cis-operator-system - catalog.cattle.io/os: linux - catalog.cattle.io/permits-os: linux,windows - catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 - catalog.cattle.io/rancher-version: '>= 2.6.0-0 < 2.7.0-0' - catalog.cattle.io/release-name: rancher-cis-benchmark - catalog.cattle.io/type: cluster-tool - catalog.cattle.io/ui-component: rancher-cis-benchmark - apiVersion: v1 - appVersion: v2.0.5-rc6 - created: "2022-07-22T18:11:24.221622589+05:30" - description: The cis-operator enables running CIS benchmark security scans on - a kubernetes cluster - digest: 3265196f9c82b94f05c9c5a810b4946eb1eeddd6967f99d14ffb986acfe3c44d - icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg - keywords: - - security - name: rancher-cis-benchmark - urls: - - assets/rancher-cis-benchmark/rancher-cis-benchmark-2.0.5-rc6.tgz - version: 2.0.5-rc6 - annotations: catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match catalog.cattle.io/certified: rancher @@ -3230,20 +3204,6 @@ entries: - assets/rancher-cis-benchmark/rancher-cis-benchmark-1.0.100.tgz version: 1.0.100 rancher-cis-benchmark-crd: - - annotations: - catalog.cattle.io/certified: rancher - catalog.cattle.io/hidden: "true" - catalog.cattle.io/namespace: cis-operator-system - catalog.cattle.io/release-name: rancher-cis-benchmark-crd - apiVersion: v1 - created: "2022-07-22T18:11:24.223698874+05:30" - description: Installs the CRDs for rancher-cis-benchmark. - digest: 397b411f3c8c99b339710e2c881afc566cc2b6953b2f211e68bb456812103f1f - name: rancher-cis-benchmark-crd - type: application - urls: - - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.0.5-rc6.tgz - version: 2.0.5-rc6 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" From 376c3b85750098d4dde06e18b641fd518894befc Mon Sep 17 00:00:00 2001 From: Rayan Das Date: Tue, 16 Aug 2022 11:09:05 +0530 Subject: [PATCH 3/3] make charts --- .../rancher-cis-benchmark-crd-2.1.0-rc1.tgz | Bin 0 -> 1467 bytes .../rancher-cis-benchmark-2.1.0-rc1.tgz | Bin 0 -> 6162 bytes .../2.1.0-rc1/Chart.yaml | 10 ++ .../2.1.0-rc1/README.md | 2 + .../2.1.0-rc1/templates/clusterscan.yaml | 148 ++++++++++++++++++ .../templates/clusterscanbenchmark.yaml | 54 +++++++ .../templates/clusterscanprofile.yaml | 36 +++++ .../templates/clusterscanreport.yaml | 39 +++++ .../2.1.0-rc1/Chart.yaml | 22 +++ .../rancher-cis-benchmark/2.1.0-rc1/README.md | 9 ++ .../2.1.0-rc1/app-readme.md | 15 ++ .../2.1.0-rc1/templates/_helpers.tpl | 27 ++++ .../2.1.0-rc1/templates/alertingrule.yaml | 14 ++ .../templates/benchmark-aks-1.0.yaml | 8 + .../templates/benchmark-cis-1.20.yaml | 8 + .../templates/benchmark-cis-1.23.yaml | 8 + .../templates/benchmark-cis-1.5.yaml | 8 + .../templates/benchmark-cis-1.6.yaml | 8 + .../templates/benchmark-eks-1.0.1.yaml | 8 + .../templates/benchmark-gke-1.0.yaml | 8 + .../benchmark-k3s-cis-1.20-hardened.yaml | 8 + .../benchmark-k3s-cis-1.20-permissive.yaml | 8 + .../benchmark-k3s-cis-1.23-hardened.yaml | 8 + .../benchmark-k3s-cis-1.23-permissive.yaml | 8 + .../benchmark-k3s-cis-1.6-hardened.yaml | 8 + .../benchmark-k3s-cis-1.6-permissive.yaml | 8 + .../benchmark-rke-cis-1.20-hardened.yaml | 8 + .../benchmark-rke-cis-1.20-permissive.yaml | 8 + .../benchmark-rke-cis-1.23-hardened.yaml | 8 + .../benchmark-rke-cis-1.23-permissive.yaml | 8 + .../benchmark-rke-cis-1.5-hardened.yaml | 8 + .../benchmark-rke-cis-1.5-permissive.yaml | 8 + .../benchmark-rke-cis-1.6-hardened.yaml | 8 + .../benchmark-rke-cis-1.6-permissive.yaml | 8 + .../benchmark-rke2-cis-1.20-hardened.yaml | 8 + .../benchmark-rke2-cis-1.20-permissive.yaml | 8 + .../benchmark-rke2-cis-1.23-hardened.yaml | 8 + .../benchmark-rke2-cis-1.23-permissive.yaml | 8 + .../benchmark-rke2-cis-1.5-hardened.yaml | 8 + .../benchmark-rke2-cis-1.5-permissive.yaml | 8 + .../benchmark-rke2-cis-1.6-hardened.yaml | 8 + .../benchmark-rke2-cis-1.6-permissive.yaml | 8 + .../2.1.0-rc1/templates/cis-roles.yaml | 49 ++++++ .../2.1.0-rc1/templates/configmap.yaml | 18 +++ .../2.1.0-rc1/templates/deployment.yaml | 55 +++++++ .../templates/network_policy_allow_all.yaml | 15 ++ .../patch_default_serviceaccount.yaml | 29 ++++ .../2.1.0-rc1/templates/rbac.yaml | 43 +++++ .../templates/scanprofile-cis-1.20.yaml | 9 ++ .../templates/scanprofile-cis-1.23.yaml | 9 ++ .../templates/scanprofile-cis-1.5.yml | 9 ++ .../templates/scanprofile-cis-1.6.yaml | 9 ++ .../scanprofile-k3s-cis-1.20-hardened.yml | 9 ++ .../scanprofile-k3s-cis-1.20-permissive.yml | 9 ++ .../scanprofile-k3s-cis-1.23-hardened.yml | 9 ++ .../scanprofile-k3s-cis-1.23-permissive.yml | 9 ++ .../scanprofile-k3s-cis-1.6-hardened.yml | 9 ++ .../scanprofile-k3s-cis-1.6-permissive.yml | 9 ++ .../scanprofile-rke-1.20-hardened.yaml | 9 ++ .../scanprofile-rke-1.20-permissive.yaml | 9 ++ .../scanprofile-rke-1.23-hardened.yaml | 9 ++ .../scanprofile-rke-1.23-permissive.yaml | 9 ++ .../scanprofile-rke-1.5-hardened.yml | 9 ++ .../scanprofile-rke-1.5-permissive.yml | 9 ++ .../scanprofile-rke-1.6-hardened.yaml | 9 ++ .../scanprofile-rke-1.6-permissive.yaml | 9 ++ .../scanprofile-rke2-cis-1.20-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.20-permissive.yml | 9 ++ .../scanprofile-rke2-cis-1.23-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.23-permissive.yml | 9 ++ .../scanprofile-rke2-cis-1.5-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.5-permissive.yml | 9 ++ .../scanprofile-rke2-cis-1.6-hardened.yml | 9 ++ .../scanprofile-rke2-cis-1.6-permissive.yml | 9 ++ .../2.1.0-rc1/templates/scanprofileaks.yml | 9 ++ .../2.1.0-rc1/templates/scanprofileeks.yml | 9 ++ .../2.1.0-rc1/templates/scanprofilegke.yml | 9 ++ .../2.1.0-rc1/templates/serviceaccount.yaml | 14 ++ .../templates/validate-install-crd.yaml | 17 ++ .../2.1.0-rc1/values.yaml | 49 ++++++ index.yaml | 40 +++++ 81 files changed, 1198 insertions(+) create mode 100644 assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0-rc1.tgz create mode 100644 assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0-rc1.tgz create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0-rc1/Chart.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0-rc1/README.md create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0-rc1/templates/clusterscan.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0-rc1/templates/clusterscanbenchmark.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0-rc1/templates/clusterscanprofile.yaml create mode 100644 charts/rancher-cis-benchmark-crd/2.1.0-rc1/templates/clusterscanreport.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/Chart.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/README.md create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/app-readme.md create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/_helpers.tpl create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/alertingrule.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-aks-1.0.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.20.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.23.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.5.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.6.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-eks-1.0.1.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-gke-1.0.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/cis-roles.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/configmap.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/deployment.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/network_policy_allow_all.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/patch_default_serviceaccount.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/rbac.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.20.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.23.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.5.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.6.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-hardened.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-permissive.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileaks.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileeks.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofilegke.yml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/serviceaccount.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/templates/validate-install-crd.yaml create mode 100644 charts/rancher-cis-benchmark/2.1.0-rc1/values.yaml diff --git a/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0-rc1.tgz b/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0-rc1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..d6e4a0a33a3532b8bf81abf252565482b050de3d GIT binary patch literal 1467 zcmV;s1w{HEiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI>(bK*7-&NIJ4bA85V6CfSla@@6ZZ7-K0>GgS$H=v6xd8BoE zOsD_7BijkKu`vciu5;`QgCu_|+24LEt*t@wCF(vGrawo?mm%oKKG*)+=@K+KD+q&& z1I=|^cRU;>zpm?+f8Ehwc;O8PSL5+u?75>0*BiT6R~O7Z)bTDB8v=dd9_*{Uxc`ZP zl!}0al4jCli~~WS77hoZ03D&;a?~Uq1o{(}aiwzDQusc~34232#y6EiB!p-p;5cEH zZ7MI9AT)1z5F0{m zILN*9V0-*~?!fbk@jvh`N5gacpThEy1ChXQgwp;q&g0LSxn>@)8Jx`pL?fRjRasl!gW7TEO>{wLx&Jg(TEd z6~v*;X4Yq4jgq%O%L#J~0ma4%z|bs~cAmFdJ%|8rAWXrY?@Ded*^sO|6%|8T$VIIK z6Ne$_l|zakDB#}bT3SIxU`zq&cHPhl=mA7=O24cdS^=3y5fy;$)(x$I{st`zK!2?p zS^-H#*QwgigW}`7QN%X7cEZlMaxX$O1YvQ-e^hri07u9j!_Ce&LIBy$^%R_J6x7P6W6StOs3RV4$@C_@lrjbxu&6=uM zQni;9!V20V5y`UIn|vLhrr9AA-F`2uf%WlOPE{BMNHw0;6P_y-Ajs`tR&ru}5LP-u z&A%e28Uj^z8m=^2ff2HTIVj_Bv$fB1>YH!QY3bVbC3nrFvmo9v^ltDQ+0eMIVAcLn zclXRSAs3czT}L%nGR@%?EEI%cB{`d@YnA(6gER@U)#y6D?GPu8A)WgBGxCA(_`X6k z#_ocS>O>Gr(Scna_;b) zXqj*{aC*^!O4(ht4|YM%42yC+9kG{r$?+`QKC+&B%A2lwj$ZyyJMQ##JbsG5L;lD^`p(0r7 z+o9AG3i*3HM=g=iWY4dF{HcDxF7WWJ0lt2~4)8o-(#um!OD>-v+NhZBFz`Tk$@{3C zedb4h*VVET={h}EZ@E9G@{_(r?9f>i;XB2z2*>X557}I`%>Pk(8fo_$up$3@qrqh< z{|~N)m*@O{3OjcG&j{0D_RqgNtH}M&4!h6%-;=<yKcu{}0yw2j}lUPGZN_|CBHt z%Kt0@tW*EY-RmFwj`WWIU~ytUP$D~KjXNdUZ+D+>PPmUhLj2e3|Lnu{`%fR7&_CEm z)AzsLa8UaGcQhQF>whP)pSFDLdd+5OALC2V#Ape`#Kz~eu|c2BS9PD%zV-^wcDA#f V?QB){UjP6A|Nop|uwVc*002(;??wOs literal 0 HcmV?d00001 diff --git a/assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0-rc1.tgz b/assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0-rc1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..3d82923154cffa244092b0c6c2a836749ad60ce7 GIT binary patch literal 6162 zcmYM2c{J4j_s6XfLPgdrSzGLD!q^$xSX-oIS5qjv@V11=8kH@S%95olO^89ZWU0g? z%P^L)k9`a?^ZHGn^F8PH`tx<}xzFc4_mBIySM&)h58b~9&eENCHM3K6H?vZ=47;f2 zrgB-)!(Q#Sll?_?#O2HCR#)!carN~GbFlT(G4s58k8U+`<>|QkCts?FPS?3G>oIG! z^6M5aZLQu_xD#`?1jg?NJyd?S_2w^kqok`5JqO*V*OQygtKMUXPwdmizpJEvof$8j ze(z8z-5$S!lBY9c?f7z*t*7LdfcW;ifHPiIeD-IuniXWo)ih)%>- za{44j!kl^0Zt6@Xj?>dFQ;ff3a0VCJ0ivw4H73ut8@^i1d0nK_s*;QFpggRY0PF-C)ATP7T(uXDxW*({KWMu_%(Vy)-6tn@&KeU9q+Rjh-N%MkFV^i??TY6T}UpJ zLE*mTYd!r5yyAiz@lTKtVw#d|UVMU;96?%WP+4%Z&NdM3R@HksEfr3GoHfMgN6xF{ zudL#~Ew^HnyIj9X(6ixP^?1xtKZ^sD_1z=OECs3o6F2_@I4|G#6q~9qB8o{oxjx3Y zPm?eWv67io(?3z-x6hd(9~WeQ8V^DTJi=g}YR;BCRv=pB+KYeI!@{$?V53HREbGQ4 z;x=1mp|Xkopqze#iJHXy?J-mP38wG}UDE}|S#wk_$Ip^kseL%X1HtIpYRxUyXlT=9 z_;{T=U1iBu1TOJ6|H1OBB}=uDv10$(DT$alyowZn{iSlvCIp|Cpdpgf;-WFgEa ziZRqx^^tY64uV=ZI}wO1J)9KEbJ)bN&VNLx7HY?!CQMm-S>tjH#ECIxaG7_8sJw9r^!H!Mo@yWRWBoVsx`^rD$!n@1g^mDt_5 z&e{rKG+)^*1^cKEOmpBAt_-t zMAj0{XY?U-uHW|P^0yG@GVuruwVKkKuzSAU_ps`X00o1%(GQ-UHXelD~@S*8-=|1i}t*CE> zcVoBVLK-jITGHH)5${P8iT#CYAxt+nzaH4$W8Eb*q~MHDNsq2)`V@`W2Xd?$D zHL8kZzhTEX;a$PnZhol#zib8(0Eg40nLft=ID->Pz}NnQP-{s2wuxa{4ATbU#P?y~1>8N}-^^wj3J1g?XWZ<;=T+Hj(sMC#*OtdARN3 zlq-b>9UTf^?EEP>$n!S?Lgy{VjEv}?r?PM@f<2P4_YDv-&KDQ(9;~z_Or^Y(*Vz2* zHhO9BZ}vce%Gy_3_4_*V85Wq??a>>hN+tcG9hcV8N%pD>Wsea&KXoVe-k9}9%49y9 zK)jn2~qb2jVa zf$?hDMChX`uXz;dWlCnst0ZV!zHsA|bWGZa>~-ch*G31@#+RDc79h5URyN@w=w(Oe zLOieDQ7Un8jqE3W~Q`Gz~o|GU3@ggmNdjC?s#8 zU6KHHdY*eB}KD0u`q`oGL{_cX10IAPQ7R_D&ZChwBnvmrJ(27@UbER^r zlc1?Oat(9oJfv>2hoq}liFP@Wh6f%AYJ-5dMuz^m$Wp2;qGSm;?LlzOLQq%OKT20{ z_PDO{PWrDSEF`FPlZrrTEMBEzVu!aNJpWkDF|U@yNcv_$n~UaK*e@HBQZ1Lf?0>jY z{r-Y&-=TF-$;`V2shLzB*>|%|1})2L5b7Suh2`8VMA%+K-#At&B1Lj(p@`B_#;}nf zhC@F!y%E{3KwoJaVgedOKs>;Y(&Q@kVVW@{zvf5_YO-w_i0=o-$yjFqBkWXBYM4hh z0nY;VPISe6ZP3MmECA>a|5XYGY4uQXZFh=aQr-*Gl!D0El|MuXsUJ^eAsA9rG=8_@N&bRM9E`Ond*b+a>_YG9IiQKvreRfO7H? z2v+gmmF)q2|NBe>rL3UpNSUDLzRTAGP>h_VCFKR_*8r?D>QMc^Six0vDy>UFWLP`} zC0Kli2M3`hjzr_Op_V5xkpO+Fpa5Lz?u{c8{_diCjIL4nHt9IGq3uIaJpSG#aD}~M z4rGc%kIduK@k8Zc6lF~I}*(@=7#|lCfBG}e8JiwXec(P7IjdsAG47& z-$YOUPv+AkxXylV7G%;;BbbV=o2%iMB0)F`M5&@cH~wjyn*;C;=skUf@mVV01f5ME zb$lOv%Ap%bXwYe|lE;bAdlNYIiXXT~cKQF{E^+G0N-T@)cMrG(LnC@=mZhf|RI3fye(QyxQQp+X zbN_~44uZ#9N~fc?{cOnOF=o+Wx{#^yFxy+b@yULZulT=-NBD#@By}tZsFwUdM3MM! zklsu1@EvCq<_D%&>IoyCj-msyw>>S zS#LpmZFA#Aq2X@@k4VAa)^#a+OQWtoWCY|xc=%jqd`NMrag;65>xtL0d-M;BIOCUB zq0-4IXMhZ8R;Si5C#9*kkP{vu`zY0QhOUR2(ze9~lgstJO4RZRnGNOVx#`MNQp(~+ znRnb+vp&=RR_;8qxai7?zGMQYNZmZ2LKKsc>WdfK{Me~Azmj{3e{bwcje(4R88J{aczije?07QtgJj+MPzhz zilW)Xz%J>X!<@;HrJc-9I-SUIZ7q!N;z~iK#9RH#ZARAB!Gi61y(RGsZ@N^`wiC8o z3OebgmMxQaRAu0LIHudAi}sI{c`kZKc*ph7Sg2iG`vx+gF`EsKN@_y$(nf2N=fnY# zI88N*Wqpej3D!Ah|FJslfuy7Jg_+^fnK(FaZd)k=fw9<B${1F{XB#iQxAS83Y*LeR$0IL^*eGR8-oyI`?BYZ*HB%ts;Wln- zZSB3r3#hrzGpKalH)YIiP3AwKT&t_pm{u}wjD$$2mtA3ES)Z3sZ^8avk0^C>cF6H} zriyOz{+118)ZG8>h~3!3ie22uz}o!E`xT-F%CCCL1s#4r;BdWXg*g7SNJLNuA^J2j zV0ZZ0dOnLq!Q*G4iA@@uJjCU-d9Iq8n<5g&1q7HEzY@x`jtnRrl~kVz*;m7{g?Q~A zh-wgOs{ODxTgQG*k`{89B8*}k5~T*~FT;^lwQ5|&_aQ0omHI?rEeE6ENOn1SCDUQxmMi3gZ}#N zf(Nz2KbgfT&USEas&@XDu>4K=&GldNCxvATT0a!uX%ZBfRq{ki$h9cny-OVOf?qlN z)H!$z7*a(I8>ZcYg#=roEMlV-cEFR+xWrKqex2%4<4pvZxPhaSZ_sD+?^?~ZruucA zqQ>OXtC;KncCCc+L!Jk)QrM2>ySry>r0c#eu=(D6+=D;#%&|U$PA*bH*WilMCr4e* zaBgBRgnOiQG!2JWa%$F7G3(BEBLQ{`Epm4YdUN=&iv)&DFXi|iiI;#gMk{tZy4j?5 z-L_WBX@2lG?}09oQ+&?uVm913cKQPKJey4H{^yqyNqpl4IsF6TIZu?gw2ee5D*Q7! z?1BBBbyrOatH z1?or0jnS5b7rJf0@BoHtEs}f4*TBMphd%8=!Sbs_(G~qo3ijJzijGmA-;+PQBEEh? z_c3+C#;P{i$6l2iJsP;s^!E7N7HTQVxiT0 zFF|-zl<&Xcd=X%#f-0;S=N?3^o}$*;J_Rj(Yv@Q&ddi^_OiBC&g$0XM1op_K z|KdfzQi+um*s1w_n5-K${R0@s!*pe$eIwW^Eq%G+o~|*uNJ2 zm5i+gacT3ATv;J#SfiWJ(5~VPrSl}Y%rUpw?O|JKm{Ng*))eU0MGBrDve*;?-f`$( zaXLV>i#mRT&h)h;V86$psSQx>Abpp{RmNlj>@|sSeFf4s-$wr>g2R^TdFXUm0Z4bH zuE|H2&{`a?`;Ta@(>y2dyBxC61*chkr^Lw)fQmKre`tgU?th?W_GurUX;|*Jjv}gt zW+zxTra>6?W#LQkp1E|6_Mg{EsR~&B>|!MWwad0am1!WK00On}|N2b}8105qNQ7XK zW>RZ7&ouA|o;%ddmvskgB$wUkY;sZM9=O~OlE#v#BdS|`DRE?%OGEV&@E?i$SgaEu z?EKxMpq(=CQQdo~alRV4QLFbq^$2G)mqXSr38tFyVI^tllRaEB+<;)F7x`LIhktCd z^CyAwRt|A=E=x3UJz(qfXIlB_zdq(<_Ib^4EQ0;G-M(IQV2`wJZl!WeXEh5KV@?0WVmwC#G20zP?Js^Y{t*wT=}6~X5;18-uuYsoeuY^BpIO8GCk2e%u)>>MnQ@@ z=GHs+vCjAqliLQb5qeg~wdI-mGV)6%b|t2*l57+^l=!aMMIx-qQ~a8|{+zD7xt`wh z?k`^w?c8&)yfvSHJ|rrS;3K>R2AhRe&@Z>!+q$8K>7&j)5_C7eG{sm3bg&P6G?{Jj z@*a$2^zh&*W;(9q)qAk)#ak3(q;SGPPM;<0geD`ydBWLLx)?=K>E3!XD{2_O&6;hD zqPcx+-U((AS4D#jQY>@9{$g`#_sLM+6$bYV!PIn7nEE^ZewBN*0h)2+3_Y7ncVN;1 z-0iMHg-dql3WRdgC(rM?Y5+LD7DE!O$9^%Ikqjf;jRNJv=nr`GNSqG&1?_TDK46A6 z@iT;U(~gB2teWMA?iU;DJdCk)5e%TO*-=Pf^F2X7bVbXMx^=h0K{l~!)a|3cPM#O; zfzs`&ggNun`a+s1Fw3y;F@Sd9^4*CU)v#}+>k@zJ!=`TX`b>%IXhb`(iF={@-4qq!ko zgS;GuD9baE$O_6s>dplC-?Csq9Ni8IVUl#4%C7we$f&`CIN#SfotNgbTqK^V`y!w1 zU6dV+yNXYK3>OoVsIVbct((RF9h>cUNWU-owzcl}+CEWkWW8hlDlxng^kmy!)OnI< z)_SCT3zK_qiMB*yV}v9|V=S`hZ75%Y`HCX@8>d8zdQL7+fm+5LQ9&(bq!t6uw^dKnHUZENI=Gx||zAOqL}aIF3{H%T^6nBf~s*)_-N3c@?ML^hi!WVezNZ?$b0!;klFqy=w&l z(rxiK+zZXPqB&bX@osVV8~5j>OMwtb!^lqug3v-I)FuY)Dd5GED2|F7lqS)T1-` z?89u)q<2J^b4g;8?l0%2h0KmKr@Z{ANXClY&WVDPCenYsRfvW88(LO;sH`PPk@7d+ zhJ71%A}i)I#I9CrR2ngh&UPBA+}}{T%*qPO6f-yqb7>8$5)i74pLN#bv1Z!TaNCAu bFy3=@b=`c1gBWS&e=u`R+ndgep6>quPL= 1.21.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 + catalog.cattle.io/rancher-version: '>= 2.6.0-0 < 2.7.0-0' + catalog.cattle.io/release-name: rancher-cis-benchmark + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: rancher-cis-benchmark +apiVersion: v1 +appVersion: v2.1.0-rc1 +description: The cis-operator enables running CIS benchmark security scans on a kubernetes + cluster +icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg +keywords: +- security +name: rancher-cis-benchmark +version: 2.1.0-rc1 diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/README.md b/charts/rancher-cis-benchmark/2.1.0-rc1/README.md new file mode 100644 index 000000000..50beab58b --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/README.md @@ -0,0 +1,9 @@ +# Rancher CIS Benchmark Chart + +The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded. + +# Installation + +``` +helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system +``` diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/app-readme.md b/charts/rancher-cis-benchmark/2.1.0-rc1/app-readme.md new file mode 100644 index 000000000..5e495d605 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/app-readme.md @@ -0,0 +1,15 @@ +# Rancher CIS Benchmarks + +This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/). + +For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/). + +This chart installs the following components: + +- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded. +- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed. +- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans. +- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources. +- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish. + - If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts. + - Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart. diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/_helpers.tpl b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/_helpers.tpl new file mode 100644 index 000000000..b7bb00042 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/_helpers.tpl @@ -0,0 +1,27 @@ +{{/* Ensure namespace is set the same everywhere */}} +{{- define "cis.namespace" -}} + {{- .Release.Namespace | default "cis-operator-system" -}} +{{- end -}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/alertingrule.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/alertingrule.yaml new file mode 100644 index 000000000..1787c88a0 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/alertingrule.yaml @@ -0,0 +1,14 @@ +{{- if .Values.alerts.enabled -}} +--- +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: rancher-cis-pod-monitor + namespace: {{ template "cis.namespace" . }} +spec: + selector: + matchLabels: + cis.cattle.io/operator: cis-operator + podMetricsEndpoints: + - port: cismetrics +{{- end }} diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-aks-1.0.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-aks-1.0.yaml new file mode 100644 index 000000000..1ac866253 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-aks-1.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: aks-1.0 +spec: + clusterProvider: aks + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.20.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.20.yaml new file mode 100644 index 000000000..898976581 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.20.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.20 +spec: + clusterProvider: "" + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.23.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.23.yaml new file mode 100644 index 000000000..a4c6d1ff2 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.23.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.23 +spec: + clusterProvider: "" + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.5.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.5.yaml new file mode 100644 index 000000000..39e8b834a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.5.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.5 +spec: + clusterProvider: "" + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.6.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.6.yaml new file mode 100644 index 000000000..93ba064f4 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-cis-1.6.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.6 +spec: + clusterProvider: "" + minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-eks-1.0.1.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-eks-1.0.1.yaml new file mode 100644 index 000000000..d1ba9d295 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-eks-1.0.1.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: eks-1.0.1 +spec: + clusterProvider: eks + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-gke-1.0.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-gke-1.0.yaml new file mode 100644 index 000000000..72122e8c5 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-gke-1.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: gke-1.0 +spec: + clusterProvider: gke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-hardened.yaml new file mode 100644 index 000000000..872bb9b3b --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.20-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-permissive.yaml new file mode 100644 index 000000000..58ec00f23 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.20-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.20-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-hardened.yaml new file mode 100644 index 000000000..bd6ce6188 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.23-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-permissive.yaml new file mode 100644 index 000000000..dd6dee3bb --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.23-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.23-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-hardened.yaml new file mode 100644 index 000000000..3ca9b6009 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.6-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-permissive.yaml new file mode 100644 index 000000000..6d4253c6e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-k3s-cis-1.6-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.6-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-hardened.yaml new file mode 100644 index 000000000..0555922ad --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.20-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-permissive.yaml new file mode 100644 index 000000000..d09e9e1ed --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.20-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.20-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-hardened.yaml new file mode 100644 index 000000000..bc6ad77a6 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.23-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-permissive.yaml new file mode 100644 index 000000000..f63b45590 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.23-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.23-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-hardened.yaml new file mode 100644 index 000000000..b5627f966 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.5-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-permissive.yaml new file mode 100644 index 000000000..95f80c0f0 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.5-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.5-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-hardened.yaml new file mode 100644 index 000000000..d75de8154 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.6-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-permissive.yaml new file mode 100644 index 000000000..52428f4a7 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke-cis-1.6-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.6-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.16.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-hardened.yaml new file mode 100644 index 000000000..95375fbea --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.20-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-permissive.yaml new file mode 100644 index 000000000..51da408b9 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.20-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.20-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.19.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-hardened.yaml new file mode 100644 index 000000000..1e2cb2a3a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.23-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-permissive.yaml new file mode 100644 index 000000000..eef970c0e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.23-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.23-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.21.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-hardened.yaml new file mode 100644 index 000000000..3d83e9bd8 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.5-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.18.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-permissive.yaml new file mode 100644 index 000000000..f66aa8f6e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.5-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.5-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.18.0" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-hardened.yaml new file mode 100644 index 000000000..3593bf371 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.6-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-permissive.yaml new file mode 100644 index 000000000..522f846ae --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/benchmark-rke2-cis-1.6-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.6-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.20.5" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/cis-roles.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/cis-roles.yaml new file mode 100644 index 000000000..23c93dc65 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/cis-roles.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cis-admin +rules: + - apiGroups: + - cis.cattle.io + resources: + - clusterscanbenchmarks + - clusterscanprofiles + - clusterscans + - clusterscanreports + verbs: ["create", "update", "delete", "patch","get", "watch", "list"] + - apiGroups: + - catalog.cattle.io + resources: ["apps"] + resourceNames: ["rancher-cis-benchmark"] + verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - configmaps + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cis-view +rules: + - apiGroups: + - cis.cattle.io + resources: + - clusterscanbenchmarks + - clusterscanprofiles + - clusterscans + - clusterscanreports + verbs: ["get", "watch", "list"] + - apiGroups: + - catalog.cattle.io + resources: ["apps"] + resourceNames: ["rancher-cis-benchmark"] + verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - configmaps + verbs: ["get", "watch", "list"] diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/configmap.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/configmap.yaml new file mode 100644 index 000000000..1a9cd1809 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/configmap.yaml @@ -0,0 +1,18 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: default-clusterscanprofiles + namespace: {{ template "cis.namespace" . }} +data: + # Default ClusterScanProfiles per cluster provider type + rke: |- + <1.21.0: rke-profile-permissive-1.20 + >=1.21.0: rke-profile-permissive-1.23 + rke2: |- + <1.21.0: rke2-cis-1.20-profile-permissive + >=1.21.0: rke2-cis-1.23-profile-permissive + eks: "eks-profile" + gke: "gke-profile" + aks: "aks-profile" + k3s: "k3s-cis-1.23-profile-permissive" + default: "cis-1.23-profile" diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/deployment.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/deployment.yaml new file mode 100644 index 000000000..ab0bb3e24 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/deployment.yaml @@ -0,0 +1,55 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cis-operator + namespace: {{ template "cis.namespace" . }} + labels: + cis.cattle.io/operator: cis-operator +spec: + selector: + matchLabels: + cis.cattle.io/operator: cis-operator + template: + metadata: + labels: + cis.cattle.io/operator: cis-operator + spec: + serviceAccountName: cis-operator-serviceaccount + containers: + - name: cis-operator + image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}' + imagePullPolicy: Always + ports: + - name: cismetrics + containerPort: {{ .Values.alerts.metricsPort }} + env: + - name: SECURITY_SCAN_IMAGE + value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }} + - name: SECURITY_SCAN_IMAGE_TAG + value: {{ .Values.image.securityScan.tag }} + - name: SONOBUOY_IMAGE + value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }} + - name: SONOBUOY_IMAGE_TAG + value: {{ .Values.image.sonobuoy.tag }} + - name: CIS_ALERTS_METRICS_PORT + value: '{{ .Values.alerts.metricsPort }}' + - name: CIS_ALERTS_SEVERITY + value: {{ .Values.alerts.severity }} + - name: CIS_ALERTS_ENABLED + value: {{ .Values.alerts.enabled | default "false" | quote }} + - name: CLUSTER_NAME + value: '{{ .Values.global.cattle.clusterName }}' + resources: + {{- toYaml .Values.resources | nindent 12 }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/network_policy_allow_all.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/network_policy_allow_all.yaml new file mode 100644 index 000000000..6ed5d645e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/network_policy_allow_all.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ template "cis.namespace" . }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/patch_default_serviceaccount.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/patch_default_serviceaccount.yaml new file mode 100644 index 000000000..e78a6bd08 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/patch_default_serviceaccount.yaml @@ -0,0 +1,29 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: patch-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + spec: + serviceAccountName: cis-operator-serviceaccount + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + restartPolicy: Never + containers: + - name: sa + image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", {{ template "cis.namespace" . }}] + + backoffLimit: 1 diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/rbac.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/rbac.yaml new file mode 100644 index 000000000..4ff88ea5f --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/rbac.yaml @@ -0,0 +1,43 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-role +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cis-operator-role +subjects: +- kind: ServiceAccount + name: cis-serviceaccount + namespace: {{ template "cis.namespace" . }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cis-operator-installer +subjects: +- kind: ServiceAccount + name: cis-operator-serviceaccount + namespace: {{ template "cis.namespace" . }} +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.20.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.20.yaml new file mode 100644 index 000000000..05263ce7d --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.20.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.20-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.20 diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.23.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.23.yaml new file mode 100644 index 000000000..c59d8f51f --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.23.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.23-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.23 diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.5.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.5.yml new file mode 100644 index 000000000..d69ae9dd5 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.5.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.5-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.5 diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.6.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.6.yaml new file mode 100644 index 000000000..8a8d8bf88 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-cis-1.6.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.6-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.6 diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-hardened.yml new file mode 100644 index 000000000..a0b6cb6f6 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.20-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-permissive.yml new file mode 100644 index 000000000..89885548d --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.20-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.20-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-hardened.yml new file mode 100644 index 000000000..724412d3a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.23-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-permissive.yml new file mode 100644 index 000000000..9f9213de1 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.23-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.23-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-hardened.yml new file mode 100644 index 000000000..095e977ab --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.6-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-permissive.yml new file mode 100644 index 000000000..3b22a80c8 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-k3s-cis-1.6-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.6-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-hardened.yaml new file mode 100644 index 000000000..c36cf38c9 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.20 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-permissive.yaml new file mode 100644 index 000000000..cfeb4b34c --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.20-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.20 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-hardened.yaml new file mode 100644 index 000000000..007331149 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.23 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-permissive.yaml new file mode 100644 index 000000000..085b60dfa --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.23-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.23 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-hardened.yml new file mode 100644 index 000000000..4eabe158a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.5 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.5-hardened \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-permissive.yml new file mode 100644 index 000000000..1f78751d1 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.5-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.5 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.5-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-hardened.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-hardened.yaml new file mode 100644 index 000000000..d38febd80 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.6 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-permissive.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-permissive.yaml new file mode 100644 index 000000000..d31b5b0d2 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke-1.6-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.6 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-hardened.yml new file mode 100644 index 000000000..decc9b651 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.20-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.20-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-permissive.yml new file mode 100644 index 000000000..74c96ffc4 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.20-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.20-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.20-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-hardened.yml new file mode 100644 index 000000000..abc1c2a21 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.23-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.23-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-permissive.yml new file mode 100644 index 000000000..51cc519ac --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.23-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.23-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.23-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-hardened.yml new file mode 100644 index 000000000..83eb3131e --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.5-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.5-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-permissive.yml new file mode 100644 index 000000000..40dc44bdf --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.5-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.5-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.5-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-hardened.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-hardened.yml new file mode 100644 index 000000000..c7ac7f949 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.6-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.6-hardened diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-permissive.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-permissive.yml new file mode 100644 index 000000000..96ca1345a --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofile-rke2-cis-1.6-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.6-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.6-permissive diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileaks.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileaks.yml new file mode 100644 index 000000000..ea7b25b40 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileaks.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: aks-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: aks-1.0 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileeks.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileeks.yml new file mode 100644 index 000000000..3b4e34437 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofileeks.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: eks-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: eks-1.0.1 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofilegke.yml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofilegke.yml new file mode 100644 index 000000000..2ddd0686f --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/scanprofilegke.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: gke-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: gke-1.0 \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/serviceaccount.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/serviceaccount.yaml new file mode 100644 index 000000000..ec48ec622 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/serviceaccount.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ template "cis.namespace" . }} + name: cis-operator-serviceaccount +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ template "cis.namespace" . }} + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-serviceaccount diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/templates/validate-install-crd.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/validate-install-crd.yaml new file mode 100644 index 000000000..562295791 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/templates/validate-install-crd.yaml @@ -0,0 +1,17 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/2.1.0-rc1/values.yaml b/charts/rancher-cis-benchmark/2.1.0-rc1/values.yaml new file mode 100644 index 000000000..ba1d0d680 --- /dev/null +++ b/charts/rancher-cis-benchmark/2.1.0-rc1/values.yaml @@ -0,0 +1,49 @@ +# Default values for rancher-cis-benchmark. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + cisoperator: + repository: rancher/cis-operator + tag: v1.0.9 + securityScan: + repository: rancher/security-scan + tag: v0.2.8-rc5 + sonobuoy: + repository: rancher/mirrored-sonobuoy-sonobuoy + tag: v0.56.7 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} + +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +affinity: {} + +global: + cattle: + systemDefaultRegistry: "" + clusterName: "" + kubectl: + repository: rancher/kubectl + tag: v1.20.2 + +alerts: + enabled: false + severity: warning + metricsPort: 8080 diff --git a/index.yaml b/index.yaml index 38888857d..c989b9572 100755 --- a/index.yaml +++ b/index.yaml @@ -2916,6 +2916,32 @@ entries: - assets/rancher-backup-crd/rancher-backup-crd-1.0.200.tgz version: 1.0.200 rancher-cis-benchmark: + - annotations: + catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: CIS Benchmark + catalog.cattle.io/kube-version: '>= 1.21.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 + catalog.cattle.io/rancher-version: '>= 2.6.0-0 < 2.7.0-0' + catalog.cattle.io/release-name: rancher-cis-benchmark + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: rancher-cis-benchmark + apiVersion: v1 + appVersion: v2.1.0-rc1 + created: "2022-08-16T11:03:57.365739871+05:30" + description: The cis-operator enables running CIS benchmark security scans on + a kubernetes cluster + digest: 50650ca5286767705a2536832d9045dc804fa0840cb485c82cf288b458251a65 + icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg + keywords: + - security + name: rancher-cis-benchmark + urls: + - assets/rancher-cis-benchmark/rancher-cis-benchmark-2.1.0-rc1.tgz + version: 2.1.0-rc1 - annotations: catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match catalog.cattle.io/certified: rancher @@ -3204,6 +3230,20 @@ entries: - assets/rancher-cis-benchmark/rancher-cis-benchmark-1.0.100.tgz version: 1.0.100 rancher-cis-benchmark-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/release-name: rancher-cis-benchmark-crd + apiVersion: v1 + created: "2022-08-16T11:03:57.368679258+05:30" + description: Installs the CRDs for rancher-cis-benchmark. + digest: 2d2148ce62d0c569d7f7e9e3c837b508c679c562346a8513b5b73830dffaca67 + name: rancher-cis-benchmark-crd + type: application + urls: + - assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-2.1.0-rc1.tgz + version: 2.1.0-rc1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true"