andata
/
rancher-charts
mirror of https://git.rancher.io/charts
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

make remove

pull/2117/head
galal-hussein 2022-10-12 20:04:38 +02:00
parent 1a9fa4de28
commit f19d9c425e
76 changed files with 0 additions and 1172 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-3.0.0-rc3.tgz
View File

Binary file not shown.

BIN
assets/rancher-cis-benchmark/rancher-cis-benchmark-3.0.0-rc3.tgz
View File

Binary file not shown.

10
charts/rancher-cis-benchmark-crd/3.0.0-rc3/Chart.yaml
View File

@ -1,10 +0,0 @@
annotations:
catalog.cattle.io/certified: rancher
catalog.cattle.io/hidden: "true"
catalog.cattle.io/namespace: cis-operator-system
catalog.cattle.io/release-name: rancher-cis-benchmark-crd
apiVersion: v1
description: Installs the CRDs for rancher-cis-benchmark.
name: rancher-cis-benchmark-crd
type: application
version: 3.0.0-rc3

2
charts/rancher-cis-benchmark-crd/3.0.0-rc3/README.md
View File

@ -1,2 +0,0 @@
# rancher-cis-benchmark-crd
A Rancher chart that installs the CRDs used by rancher-cis-benchmark.

148
charts/rancher-cis-benchmark-crd/3.0.0-rc3/templates/clusterscan.yaml
View File

@ -1,148 +0,0 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: clusterscans.cis.cattle.io
spec:
group: cis.cattle.io
names:
kind: ClusterScan
plural: clusterscans
scope: Cluster
versions:
- name: v1
served: true
storage: true
additionalPrinterColumns:
- jsonPath: .status.lastRunScanProfileName
name: ClusterScanProfile
type: string
- jsonPath: .status.summary.total
name: Total
type: string
- jsonPath: .status.summary.pass
name: Pass
type: string
- jsonPath: .status.summary.fail
name: Fail
type: string
- jsonPath: .status.summary.skip
name: Skip
type: string
- jsonPath: .status.summary.warn
name: Warn
type: string
- jsonPath: .status.summary.notApplicable
name: Not Applicable
type: string
- jsonPath: .status.lastRunTimestamp
name: LastRunTimestamp
type: string
- jsonPath: .spec.scheduledScanConfig.cronSchedule
name: CronSchedule
type: string
subresources:
status: {}
schema:
openAPIV3Schema:
properties:
spec:
properties:
scanProfileName:
nullable: true
type: string
scheduledScanConfig:
nullable: true
properties:
cronSchedule:
nullable: true
type: string
retentionCount:
type: integer
scanAlertRule:
nullable: true
properties:
alertOnComplete:
type: boolean
alertOnFailure:
type: boolean
type: object
type: object
scoreWarning:
enum:
- pass
- fail
nullable: true
type: string
type: object
status:
properties:
NextScanAt:
nullable: true
type: string
ScanAlertingRuleName:
nullable: true
type: string
conditions:
items:
properties:
lastTransitionTime:
nullable: true
type: string
lastUpdateTime:
nullable: true
type: string
message:
nullable: true
type: string
reason:
nullable: true
type: string
status:
nullable: true
type: string
type:
nullable: true
type: string
type: object
nullable: true
type: array
display:
nullable: true
properties:
error:
type: boolean
message:
nullable: true
type: string
state:
nullable: true
type: string
transitioning:
type: boolean
type: object
lastRunScanProfileName:
nullable: true
type: string
lastRunTimestamp:
nullable: true
type: string
observedGeneration:
type: integer
summary:
nullable: true
properties:
fail:
type: integer
notApplicable:
type: integer
pass:
type: integer
skip:
type: integer
total:
type: integer
warn:
type: integer
type: object
type: object
type: object

54
charts/rancher-cis-benchmark-crd/3.0.0-rc3/templates/clusterscanbenchmark.yaml
View File

@ -1,54 +0,0 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: clusterscanbenchmarks.cis.cattle.io
spec:
group: cis.cattle.io
names:
kind: ClusterScanBenchmark
plural: clusterscanbenchmarks
scope: Cluster
versions:
- name: v1
served: true
storage: true
additionalPrinterColumns:
- jsonPath: .spec.clusterProvider
name: ClusterProvider
type: string
- jsonPath: .spec.minKubernetesVersion
name: MinKubernetesVersion
type: string
- jsonPath: .spec.maxKubernetesVersion
name: MaxKubernetesVersion
type: string
- jsonPath: .spec.customBenchmarkConfigMapName
name: customBenchmarkConfigMapName
type: string
- jsonPath: .spec.customBenchmarkConfigMapNamespace
name: customBenchmarkConfigMapNamespace
type: string
subresources:
status: {}
schema:
openAPIV3Schema:
properties:
spec:
properties:
clusterProvider:
nullable: true
type: string
customBenchmarkConfigMapName:
nullable: true
type: string
customBenchmarkConfigMapNamespace:
nullable: true
type: string
maxKubernetesVersion:
nullable: true
type: string
minKubernetesVersion:
nullable: true
type: string
type: object
type: object

36
charts/rancher-cis-benchmark-crd/3.0.0-rc3/templates/clusterscanprofile.yaml
View File

@ -1,36 +0,0 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: clusterscanprofiles.cis.cattle.io
spec:
group: cis.cattle.io
names:
kind: ClusterScanProfile
plural: clusterscanprofiles
scope: Cluster
versions:
- name: v1
served: true
storage: true
subresources:
status: {}
schema:
openAPIV3Schema:
properties:
spec:
properties:
benchmarkVersion:
nullable: true
type: string
skipTests:
items:
nullable: true
type: string
nullable: true
type: array
type: object
type: object
additionalPrinterColumns:
- jsonPath: .spec.benchmarkVersion
name: BenchmarkVersion
type: string

39
charts/rancher-cis-benchmark-crd/3.0.0-rc3/templates/clusterscanreport.yaml
View File

@ -1,39 +0,0 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: clusterscanreports.cis.cattle.io
spec:
group: cis.cattle.io
names:
kind: ClusterScanReport
plural: clusterscanreports
scope: Cluster
versions:
- name: v1
served: true
storage: true
additionalPrinterColumns:
- jsonPath: .spec.lastRunTimestamp
name: LastRunTimestamp
type: string
- jsonPath: .spec.benchmarkVersion
name: BenchmarkVersion
type: string
subresources:
status: {}
schema:
openAPIV3Schema:
properties:
spec:
properties:
benchmarkVersion:
nullable: true
type: string
lastRunTimestamp:
nullable: true
type: string
reportJSON:
nullable: true
type: string
type: object
type: object

22
charts/rancher-cis-benchmark/3.0.0-rc3/Chart.yaml
View File

@ -1,22 +0,0 @@
annotations:
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: CIS Benchmark
catalog.cattle.io/kube-version: '>= 1.21.0-0 < 1.25.0-0'
catalog.cattle.io/namespace: cis-operator-system
catalog.cattle.io/os: linux
catalog.cattle.io/permits-os: linux,windows
catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
catalog.cattle.io/release-name: rancher-cis-benchmark
catalog.cattle.io/type: cluster-tool
catalog.cattle.io/ui-component: rancher-cis-benchmark
apiVersion: v1
appVersion: v3.0.0
description: The cis-operator enables running CIS benchmark security scans on a kubernetes
cluster
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
keywords:
- security
name: rancher-cis-benchmark
version: 3.0.0-rc3

9
charts/rancher-cis-benchmark/3.0.0-rc3/README.md
View File

@ -1,9 +0,0 @@
# Rancher CIS Benchmark Chart
The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded.
# Installation
```
helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system
```

15
charts/rancher-cis-benchmark/3.0.0-rc3/app-readme.md
View File

@ -1,15 +0,0 @@
# Rancher CIS Benchmarks
This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/).
This chart installs the following components:
- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded.
- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed.
- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans.
- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources.
- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish.
- If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts.
- Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart.

27
charts/rancher-cis-benchmark/3.0.0-rc3/templates/_helpers.tpl
View File

@ -1,27 +0,0 @@
{{/* Ensure namespace is set the same everywhere */}}
{{- define "cis.namespace" -}}
{{- .Release.Namespace | default "cis-operator-system" -}}
{{- end -}}
{{- define "system_default_registry" -}}
{{- if .Values.global.cattle.systemDefaultRegistry -}}
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
{{- else -}}
{{- "" -}}
{{- end -}}
{{- end -}}
{{/*
Windows cluster will add default taint for linux nodes,
add below linux tolerations to workloads could be scheduled to those linux nodes
*/}}
{{- define "linux-node-tolerations" -}}
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
{{- end -}}
{{- define "linux-node-selector" -}}
kubernetes.io/os: linux
{{- end -}}

14
charts/rancher-cis-benchmark/3.0.0-rc3/templates/alertingrule.yaml
View File

@ -1,14 +0,0 @@
{{- if .Values.alerts.enabled -}}
---
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: rancher-cis-pod-monitor
namespace: {{ template "cis.namespace" . }}
spec:
selector:
matchLabels:
cis.cattle.io/operator: cis-operator
podMetricsEndpoints:
- port: cismetrics
{{- end }}

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-aks-1.0.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: aks-1.0
spec:
clusterProvider: aks
minKubernetesVersion: "1.15.0"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-cis-1.20.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: cis-1.20
spec:
clusterProvider: ""
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-cis-1.23.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: cis-1.23
spec:
clusterProvider: ""
minKubernetesVersion: "1.22.0"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-cis-1.5.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: cis-1.5
spec:
clusterProvider: ""
minKubernetesVersion: "1.15.0"
maxKubernetesVersion: "1.15.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-cis-1.6.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: cis-1.6
spec:
clusterProvider: ""
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-eks-1.0.1.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: eks-1.0.1
spec:
clusterProvider: eks
minKubernetesVersion: "1.15.0"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-gke-1.0.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: gke-1.0
spec:
clusterProvider: gke
minKubernetesVersion: "1.15.0"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-k3s-cis-1.20-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: k3s-cis-1.20-hardened
spec:
clusterProvider: k3s
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-k3s-cis-1.20-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: k3s-cis-1.20-permissive
spec:
clusterProvider: k3s
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-k3s-cis-1.23-hardened.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: k3s-cis-1.23-hardened
spec:
clusterProvider: k3s
minKubernetesVersion: "1.22.0"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-k3s-cis-1.23-permissive.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: k3s-cis-1.23-permissive
spec:
clusterProvider: k3s
minKubernetesVersion: "1.22.0"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-k3s-cis-1.6-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: k3s-cis-1.6-hardened
spec:
clusterProvider: k3s
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-k3s-cis-1.6-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: k3s-cis-1.6-permissive
spec:
clusterProvider: k3s
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.20-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.20-hardened
spec:
clusterProvider: rke
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.20-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.20-permissive
spec:
clusterProvider: rke
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.23-hardened.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.23-hardened
spec:
clusterProvider: rke
minKubernetesVersion: "1.22.0"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.23-permissive.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.23-permissive
spec:
clusterProvider: rke
minKubernetesVersion: "1.22.0"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.5-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.5-hardened
spec:
clusterProvider: rke
minKubernetesVersion: "1.15.0"
maxKubernetesVersion: "1.15.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.5-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.5-permissive
spec:
clusterProvider: rke
minKubernetesVersion: "1.15.0"
maxKubernetesVersion: "1.15.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.6-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.6-hardened
spec:
clusterProvider: rke
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke-cis-1.6-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke-cis-1.6-permissive
spec:
clusterProvider: rke
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.20-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.20-hardened
spec:
clusterProvider: rke2
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.20-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.20-permissive
spec:
clusterProvider: rke2
minKubernetesVersion: "1.19.0"
maxKubernetesVersion: "1.21.x"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.23-hardened.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.23-hardened
spec:
clusterProvider: rke2
minKubernetesVersion: "1.22.0"

8
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.23-permissive.yaml
View File

@ -1,8 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.23-permissive
spec:
clusterProvider: rke2
minKubernetesVersion: "1.22.0"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.5-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.5-hardened
spec:
clusterProvider: rke2
minKubernetesVersion: "1.15.0"
maxKubernetesVersion: "1.15.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.5-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.5-permissive
spec:
clusterProvider: rke2
minKubernetesVersion: "1.15.0"
maxKubernetesVersion: "1.15.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.6-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.6-hardened
spec:
clusterProvider: rke2
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/benchmark-rke2-cis-1.6-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanBenchmark
metadata:
name: rke2-cis-1.6-permissive
spec:
clusterProvider: rke2
minKubernetesVersion: "1.16.0"
maxKubernetesVersion: "1.18.x"

49
charts/rancher-cis-benchmark/3.0.0-rc3/templates/cis-roles.yaml
View File

@ -1,49 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cis-admin
rules:
- apiGroups:
- cis.cattle.io
resources:
- clusterscanbenchmarks
- clusterscanprofiles
- clusterscans
- clusterscanreports
verbs: ["create", "update", "delete", "patch","get", "watch", "list"]
- apiGroups:
- catalog.cattle.io
resources: ["apps"]
resourceNames: ["rancher-cis-benchmark"]
verbs: ["get", "watch", "list"]
- apiGroups:
- ""
resources:
- configmaps
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cis-view
rules:
- apiGroups:
- cis.cattle.io
resources:
- clusterscanbenchmarks
- clusterscanprofiles
- clusterscans
- clusterscanreports
verbs: ["get", "watch", "list"]
- apiGroups:
- catalog.cattle.io
resources: ["apps"]
resourceNames: ["rancher-cis-benchmark"]
verbs: ["get", "watch", "list"]
- apiGroups:
- ""
resources:
- configmaps
verbs: ["get", "watch", "list"]

18
charts/rancher-cis-benchmark/3.0.0-rc3/templates/configmap.yaml
View File

@ -1,18 +0,0 @@
kind: ConfigMap
apiVersion: v1
metadata:
name: default-clusterscanprofiles
namespace: {{ template "cis.namespace" . }}
data:
# Default ClusterScanProfiles per cluster provider type
rke: |-
<1.21.0: rke-profile-permissive-1.20
>=1.21.0: rke-profile-permissive-1.23
rke2: |-
<1.21.0: rke2-cis-1.20-profile-permissive
>=1.21.0: rke2-cis-1.23-profile-permissive
eks: "eks-profile"
gke: "gke-profile"
aks: "aks-profile"
k3s: "k3s-cis-1.23-profile-permissive"
default: "cis-1.23-profile"

55
charts/rancher-cis-benchmark/3.0.0-rc3/templates/deployment.yaml
View File

@ -1,55 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: cis-operator
namespace: {{ template "cis.namespace" . }}
labels:
cis.cattle.io/operator: cis-operator
spec:
selector:
matchLabels:
cis.cattle.io/operator: cis-operator
template:
metadata:
labels:
cis.cattle.io/operator: cis-operator
spec:
serviceAccountName: cis-operator-serviceaccount
containers:
- name: cis-operator
image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}'
imagePullPolicy: Always
ports:
- name: cismetrics
containerPort: {{ .Values.alerts.metricsPort }}
env:
- name: SECURITY_SCAN_IMAGE
value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }}
- name: SECURITY_SCAN_IMAGE_TAG
value: {{ .Values.image.securityScan.tag }}
- name: SONOBUOY_IMAGE
value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }}
- name: SONOBUOY_IMAGE_TAG
value: {{ .Values.image.sonobuoy.tag }}
- name: CIS_ALERTS_METRICS_PORT
value: '{{ .Values.alerts.metricsPort }}'
- name: CIS_ALERTS_SEVERITY
value: {{ .Values.alerts.severity }}
- name: CIS_ALERTS_ENABLED
value: {{ .Values.alerts.enabled | default "false" | quote }}
- name: CLUSTER_NAME
value: '{{ .Values.global.cattle.clusterName }}'
resources:
{{- toYaml .Values.resources | nindent 12 }}
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
{{- if .Values.nodeSelector }}
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
{{- if .Values.tolerations }}
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}

15
charts/rancher-cis-benchmark/3.0.0-rc3/templates/network_policy_allow_all.yaml
View File

@ -1,15 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-allow-all
namespace: {{ template "cis.namespace" . }}
spec:
podSelector: {}
ingress:
- {}
egress:
- {}
policyTypes:
- Ingress
- Egress

29
charts/rancher-cis-benchmark/3.0.0-rc3/templates/patch_default_serviceaccount.yaml
View File

@ -1,29 +0,0 @@
---
apiVersion: batch/v1
kind: Job
metadata:
name: patch-sa
annotations:
"helm.sh/hook": post-install, post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
spec:
template:
spec:
serviceAccountName: cis-operator-serviceaccount
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
{{- if .Values.nodeSelector }}
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
{{- if .Values.tolerations }}
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
restartPolicy: Never
containers:
- name: sa
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"]
args: ["-n", {{ template "cis.namespace" . }}]
backoffLimit: 1

43
charts/rancher-cis-benchmark/3.0.0-rc3/templates/rbac.yaml
View File

@ -1,43 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/name: rancher-cis-benchmark
app.kubernetes.io/instance: release-name
name: cis-operator-role
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/name: rancher-cis-benchmark
app.kubernetes.io/instance: release-name
name: cis-operator-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cis-operator-role
subjects:
- kind: ServiceAccount
name: cis-serviceaccount
namespace: {{ template "cis.namespace" . }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: cis-operator-installer
subjects:
- kind: ServiceAccount
name: cis-operator-serviceaccount
namespace: {{ template "cis.namespace" . }}
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-cis-1.20.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: cis-1.20-profile
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: cis-1.20

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-cis-1.23.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: cis-1.23-profile
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: cis-1.23

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-cis-1.6.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: cis-1.6-profile
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: cis-1.6

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-k3s-cis-1.20-hardened.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: k3s-cis-1.20-profile-hardened
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: k3s-cis-1.20-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-k3s-cis-1.20-permissive.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: k3s-cis-1.20-profile-permissive
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: k3s-cis-1.20-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-k3s-cis-1.23-hardened.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: k3s-cis-1.23-profile-hardened
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: k3s-cis-1.23-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-k3s-cis-1.23-permissive.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: k3s-cis-1.23-profile-permissive
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: k3s-cis-1.23-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-k3s-cis-1.6-hardened.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: k3s-cis-1.6-profile-hardened
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: k3s-cis-1.6-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-k3s-cis-1.6-permissive.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: k3s-cis-1.6-profile-permissive
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: k3s-cis-1.6-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke-1.20-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke-profile-hardened-1.20
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke-cis-1.20-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke-1.20-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke-profile-permissive-1.20
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke-cis-1.20-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke-1.23-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke-profile-hardened-1.23
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke-cis-1.23-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke-1.23-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke-profile-permissive-1.23
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke-cis-1.23-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke-1.6-hardened.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke-profile-hardened-1.6
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke-cis-1.6-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke-1.6-permissive.yaml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke-profile-permissive-1.6
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke-cis-1.6-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke2-cis-1.20-hardened.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke2-cis-1.20-profile-hardened
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke2-cis-1.20-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke2-cis-1.20-permissive.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke2-cis-1.20-profile-permissive
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke2-cis-1.20-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke2-cis-1.23-hardened.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke2-cis-1.23-profile-hardened
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke2-cis-1.23-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke2-cis-1.23-permissive.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke2-cis-1.23-profile-permissive
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke2-cis-1.23-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke2-cis-1.6-hardened.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke2-cis-1.6-profile-hardened
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke2-cis-1.6-hardened

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofile-rke2-cis-1.6-permissive.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: rke2-cis-1.6-profile-permissive
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: rke2-cis-1.6-permissive

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofileaks.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: aks-profile
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: aks-1.0

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofileeks.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: eks-profile
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: eks-1.0.1

9
charts/rancher-cis-benchmark/3.0.0-rc3/templates/scanprofilegke.yml
View File

@ -1,9 +0,0 @@
---
apiVersion: cis.cattle.io/v1
kind: ClusterScanProfile
metadata:
name: gke-profile
annotations:
clusterscanprofile.cis.cattle.io/builtin: "true"
spec:
benchmarkVersion: gke-1.0

14
charts/rancher-cis-benchmark/3.0.0-rc3/templates/serviceaccount.yaml
View File

@ -1,14 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: {{ template "cis.namespace" . }}
name: cis-operator-serviceaccount
---
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: {{ template "cis.namespace" . }}
labels:
app.kubernetes.io/name: rancher-cis-benchmark
app.kubernetes.io/instance: release-name
name: cis-serviceaccount

17
charts/rancher-cis-benchmark/3.0.0-rc3/templates/validate-install-crd.yaml
View File

@ -1,17 +0,0 @@
#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}}
# {{- $found := dict -}}
# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}}
# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}}
# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}}
# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}}
# {{- range .Capabilities.APIVersions -}}
# {{- if hasKey $found (toString .) -}}
# {{- set $found (toString .) true -}}
# {{- end -}}
# {{- end -}}
# {{- range $_, $exists := $found -}}
# {{- if (eq $exists false) -}}
# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}}
# {{- end -}}
# {{- end -}}
#{{- end -}}

49
charts/rancher-cis-benchmark/3.0.0-rc3/values.yaml
View File

@ -1,49 +0,0 @@
# Default values for rancher-cis-benchmark.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
image:
cisoperator:
repository: rancher/cis-operator
tag: v1.0.10-rc2
securityScan:
repository: rancher/security-scan
tag: v0.2.9-rc3
sonobuoy:
repository: rancher/mirrored-sonobuoy-sonobuoy
tag: v0.56.7
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
## List of node taints to tolerate (requires Kubernetes >= 1.6)
tolerations: []
affinity: {}
global:
cattle:
systemDefaultRegistry: ""
clusterName: ""
kubectl:
repository: rancher/kubectl
tag: v1.20.2
alerts:
enabled: false
severity: warning
metricsPort: 8080

40
index.yaml
View File

@ -3369,32 +3369,6 @@ entries:
- assets/rancher-backup-crd/rancher-backup-crd-1.0.200.tgz
version: 1.0.200
rancher-cis-benchmark:
- annotations:
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: CIS Benchmark
catalog.cattle.io/kube-version: '>= 1.21.0-0 < 1.25.0-0'
catalog.cattle.io/namespace: cis-operator-system
catalog.cattle.io/os: linux
catalog.cattle.io/permits-os: linux,windows
catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
catalog.cattle.io/release-name: rancher-cis-benchmark
catalog.cattle.io/type: cluster-tool
catalog.cattle.io/ui-component: rancher-cis-benchmark
apiVersion: v1
appVersion: v3.0.0
created: "2022-09-27T12:56:21.141597878+05:30"
description: The cis-operator enables running CIS benchmark security scans on
a kubernetes cluster
digest: 0f6b96ff0a30558b0fbfa30ca0a481dbbfb5cc914404d67fba5d24345a132fee
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
keywords:
- security
name: rancher-cis-benchmark
urls:
- assets/rancher-cis-benchmark/rancher-cis-benchmark-3.0.0-rc3.tgz
version: 3.0.0-rc3
- annotations:
catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match
catalog.cattle.io/certified: rancher
@ -3709,20 +3683,6 @@ entries:
- assets/rancher-cis-benchmark/rancher-cis-benchmark-1.0.100.tgz
version: 1.0.100
rancher-cis-benchmark-crd:
- annotations:
catalog.cattle.io/certified: rancher
catalog.cattle.io/hidden: "true"
catalog.cattle.io/namespace: cis-operator-system
catalog.cattle.io/release-name: rancher-cis-benchmark-crd
apiVersion: v1
created: "2022-09-27T12:56:21.14359279+05:30"
description: Installs the CRDs for rancher-cis-benchmark.
digest: 7f51d13d807619f495c0cf3a1c0dec2e0c7a7187a315b1fc2867ca60493fb517
name: rancher-cis-benchmark-crd
type: application
urls:
- assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-3.0.0-rc3.tgz
version: 3.0.0-rc3
- annotations:
catalog.cattle.io/certified: rancher
catalog.cattle.io/hidden: "true"