andata
/
rancher-charts
mirror of https://git.rancher.io/charts
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
rancher-charts/packages/rancher-cis-benchmark/charts/app-readme.md

3.6 KiB
Raw Blame History

Rancher CIS Benchmarks

This chart enables security scanning of the cluster using CIS (Center for Internet Security) benchmarks.

For more information on how to use the feature, refer to our docs.

This chart installs the following components:

  • cis-operator - The cis-operator handles launching the kube-bench tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded.
  • Scans - A scan is a CRD (ClusterScan) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed.
  • Profiles - A profile is a CRD (ClusterScanProfile) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default ClusterScanProfile custom resources with no skipped tests, which can immediately be used to launch CIS scans.
  • Benchmark Versions - A benchmark version is a CRD (ClusterScanBenchmark) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default ClusterScanBenchmark custom resources.
  • Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish.
    • If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that Rancher's Monitoring and Alerting application is pre-installed and the Receivers and Routes are configured to send out alerts.
    • Additionally, you need to set alerts: true in the Values YAML while installing or upgrading this chart.

Upgrading to Kubernetes v1.25+

Starting in Kubernetes v1.25, Pod Security Policies have been removed from the Kubernetes API.

As a result, before upgrading to Kubernetes v1.25 (or on a fresh install in a Kubernetes v1.25+ cluster), users are expected to perform an in-place upgrade of this chart with global.cattle.psp.enabled set to false if it has been previously set to true.

Note: In this chart release, any previous field that was associated with any PSP resources have been removed in favor of a single global field: global.cattle.psp.enabled.

Note: If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a helm upgrade (even if you manually clean up resources), it will leave the Helm release in a broken state within the cluster such that further Helm operations will not work (helm uninstall, helm upgrade, etc.).

If your charts get stuck in this state, please consult the Rancher docs on how to clean up your Helm release secrets.

Upon setting global.cattle.psp.enabled to false, the chart will remove any PSP resources deployed on its behalf from the cluster. This is the default setting for this chart.

As a replacement for PSPs, Pod Security Admission should be used. Please consult the Rancher docs for more details on how to configure your chart release namespaces to work with the new Pod Security Admission and apply Pod Security Standards.