-
Notifications
You must be signed in to change notification settings - Fork 716
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
ab8e449
commit 1b8c9bb
Showing
57 changed files
with
1,203 additions
and
0 deletions.
There are no files selected for viewing
Binary file added
BIN
+1.44 KB
assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-6.3.0-rc.1.tgz
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| annotations: | ||
| catalog.cattle.io/certified: rancher | ||
| catalog.cattle.io/hidden: "true" | ||
| catalog.cattle.io/namespace: cis-operator-system | ||
| catalog.cattle.io/release-name: rancher-cis-benchmark-crd | ||
| apiVersion: v1 | ||
| description: Installs the CRDs for rancher-cis-benchmark. | ||
| name: rancher-cis-benchmark-crd | ||
| type: application | ||
| version: 6.3.0-rc.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| # rancher-cis-benchmark-crd | ||
| A Rancher chart that installs the CRDs used by rancher-cis-benchmark. |
149 changes: 149 additions & 0 deletions
149
charts/rancher-cis-benchmark-crd/6.3.0-rc.1/templates/clusterscan.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,149 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: clusterscans.cis.cattle.io | ||
| spec: | ||
| group: cis.cattle.io | ||
| names: | ||
| kind: ClusterScan | ||
| plural: clusterscans | ||
| singular: clusterscan | ||
| scope: Cluster | ||
| versions: | ||
| - additionalPrinterColumns: | ||
| - jsonPath: .status.lastRunScanProfileName | ||
| name: ClusterScanProfile | ||
| type: string | ||
| - jsonPath: .status.summary.total | ||
| name: Total | ||
| type: string | ||
| - jsonPath: .status.summary.pass | ||
| name: Pass | ||
| type: string | ||
| - jsonPath: .status.summary.fail | ||
| name: Fail | ||
| type: string | ||
| - jsonPath: .status.summary.skip | ||
| name: Skip | ||
| type: string | ||
| - jsonPath: .status.summary.warn | ||
| name: Warn | ||
| type: string | ||
| - jsonPath: .status.summary.notApplicable | ||
| name: Not Applicable | ||
| type: string | ||
| - jsonPath: .status.lastRunTimestamp | ||
| name: LastRunTimestamp | ||
| type: string | ||
| - jsonPath: .spec.scheduledScanConfig.cronSchedule | ||
| name: CronSchedule | ||
| type: string | ||
| name: v1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| properties: | ||
| spec: | ||
| properties: | ||
| scanProfileName: | ||
| nullable: true | ||
| type: string | ||
| scheduledScanConfig: | ||
| nullable: true | ||
| properties: | ||
| cronSchedule: | ||
| nullable: true | ||
| type: string | ||
| retentionCount: | ||
| type: integer | ||
| scanAlertRule: | ||
| nullable: true | ||
| properties: | ||
| alertOnComplete: | ||
| type: boolean | ||
| alertOnFailure: | ||
| type: boolean | ||
| type: object | ||
| type: object | ||
| scoreWarning: | ||
| enum: | ||
| - pass | ||
| - fail | ||
| nullable: true | ||
| type: string | ||
| type: object | ||
| status: | ||
| properties: | ||
| NextScanAt: | ||
| nullable: true | ||
| type: string | ||
| ScanAlertingRuleName: | ||
| nullable: true | ||
| type: string | ||
| conditions: | ||
| items: | ||
| properties: | ||
| lastTransitionTime: | ||
| nullable: true | ||
| type: string | ||
| lastUpdateTime: | ||
| nullable: true | ||
| type: string | ||
| message: | ||
| nullable: true | ||
| type: string | ||
| reason: | ||
| nullable: true | ||
| type: string | ||
| status: | ||
| nullable: true | ||
| type: string | ||
| type: | ||
| nullable: true | ||
| type: string | ||
| type: object | ||
| nullable: true | ||
| type: array | ||
| display: | ||
| nullable: true | ||
| properties: | ||
| error: | ||
| type: boolean | ||
| message: | ||
| nullable: true | ||
| type: string | ||
| state: | ||
| nullable: true | ||
| type: string | ||
| transitioning: | ||
| type: boolean | ||
| type: object | ||
| lastRunScanProfileName: | ||
| nullable: true | ||
| type: string | ||
| lastRunTimestamp: | ||
| nullable: true | ||
| type: string | ||
| observedGeneration: | ||
| type: integer | ||
| summary: | ||
| nullable: true | ||
| properties: | ||
| fail: | ||
| type: integer | ||
| notApplicable: | ||
| type: integer | ||
| pass: | ||
| type: integer | ||
| skip: | ||
| type: integer | ||
| total: | ||
| type: integer | ||
| warn: | ||
| type: integer | ||
| type: object | ||
| type: object | ||
| type: object | ||
| served: true | ||
| storage: true | ||
| subresources: | ||
| status: {} |
55 changes: 55 additions & 0 deletions
55
charts/rancher-cis-benchmark-crd/6.3.0-rc.1/templates/clusterscanbenchmark.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: clusterscanbenchmarks.cis.cattle.io | ||
| spec: | ||
| group: cis.cattle.io | ||
| names: | ||
| kind: ClusterScanBenchmark | ||
| plural: clusterscanbenchmarks | ||
| singular: clusterscanbenchmark | ||
| scope: Cluster | ||
| versions: | ||
| - additionalPrinterColumns: | ||
| - jsonPath: .spec.clusterProvider | ||
| name: ClusterProvider | ||
| type: string | ||
| - jsonPath: .spec.minKubernetesVersion | ||
| name: MinKubernetesVersion | ||
| type: string | ||
| - jsonPath: .spec.maxKubernetesVersion | ||
| name: MaxKubernetesVersion | ||
| type: string | ||
| - jsonPath: .spec.customBenchmarkConfigMapName | ||
| name: customBenchmarkConfigMapName | ||
| type: string | ||
| - jsonPath: .spec.customBenchmarkConfigMapNamespace | ||
| name: customBenchmarkConfigMapNamespace | ||
| type: string | ||
| name: v1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| properties: | ||
| spec: | ||
| properties: | ||
| clusterProvider: | ||
| nullable: true | ||
| type: string | ||
| customBenchmarkConfigMapName: | ||
| nullable: true | ||
| type: string | ||
| customBenchmarkConfigMapNamespace: | ||
| nullable: true | ||
| type: string | ||
| maxKubernetesVersion: | ||
| nullable: true | ||
| type: string | ||
| minKubernetesVersion: | ||
| nullable: true | ||
| type: string | ||
| type: object | ||
| type: object | ||
| served: true | ||
| storage: true | ||
| subresources: | ||
| status: {} |
37 changes: 37 additions & 0 deletions
37
charts/rancher-cis-benchmark-crd/6.3.0-rc.1/templates/clusterscanprofile.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: clusterscanprofiles.cis.cattle.io | ||
| spec: | ||
| group: cis.cattle.io | ||
| names: | ||
| kind: ClusterScanProfile | ||
| plural: clusterscanprofiles | ||
| singular: clusterscanprofile | ||
| scope: Cluster | ||
| versions: | ||
| - additionalPrinterColumns: | ||
| - jsonPath: .spec.benchmarkVersion | ||
| name: BenchmarkVersion | ||
| type: string | ||
| name: v1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| properties: | ||
| spec: | ||
| properties: | ||
| benchmarkVersion: | ||
| nullable: true | ||
| type: string | ||
| skipTests: | ||
| items: | ||
| nullable: true | ||
| type: string | ||
| nullable: true | ||
| type: array | ||
| type: object | ||
| type: object | ||
| served: true | ||
| storage: true | ||
| subresources: | ||
| status: {} |
40 changes: 40 additions & 0 deletions
40
charts/rancher-cis-benchmark-crd/6.3.0-rc.1/templates/clusterscanreport.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: clusterscanreports.cis.cattle.io | ||
| spec: | ||
| group: cis.cattle.io | ||
| names: | ||
| kind: ClusterScanReport | ||
| plural: clusterscanreports | ||
| singular: clusterscanreport | ||
| scope: Cluster | ||
| versions: | ||
| - additionalPrinterColumns: | ||
| - jsonPath: .spec.lastRunTimestamp | ||
| name: LastRunTimestamp | ||
| type: string | ||
| - jsonPath: .spec.benchmarkVersion | ||
| name: BenchmarkVersion | ||
| type: string | ||
| name: v1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| properties: | ||
| spec: | ||
| properties: | ||
| benchmarkVersion: | ||
| nullable: true | ||
| type: string | ||
| lastRunTimestamp: | ||
| nullable: true | ||
| type: string | ||
| reportJSON: | ||
| nullable: true | ||
| type: string | ||
| type: object | ||
| type: object | ||
| served: true | ||
| storage: true | ||
| subresources: | ||
| status: {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| annotations: | ||
| catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match | ||
| catalog.cattle.io/certified: rancher | ||
| catalog.cattle.io/display-name: CIS Benchmark | ||
| catalog.cattle.io/kube-version: '>= 1.27.0-0 < 1.31.0-0' | ||
| catalog.cattle.io/namespace: cis-operator-system | ||
| catalog.cattle.io/os: linux | ||
| catalog.cattle.io/permits-os: linux,windows | ||
| catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 | ||
| catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' | ||
| catalog.cattle.io/release-name: rancher-cis-benchmark | ||
| catalog.cattle.io/type: cluster-tool | ||
| catalog.cattle.io/ui-component: rancher-cis-benchmark | ||
| apiVersion: v1 | ||
| appVersion: v6.3.0-rc.1 | ||
| description: The cis-operator enables running CIS benchmark security scans on a kubernetes | ||
| cluster | ||
| icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg | ||
| keywords: | ||
| - security | ||
| name: rancher-cis-benchmark | ||
| version: 6.3.0-rc.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # Rancher CIS Benchmark Chart | ||
|
|
||
| The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded. | ||
|
|
||
| # Installation | ||
|
|
||
| ``` | ||
| helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # Rancher CIS Benchmarks | ||
|
|
||
| This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/). | ||
|
|
||
| For more information on how to use the feature, refer to our [docs](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides). | ||
|
|
||
| This chart installs the following components: | ||
|
|
||
| - [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded. | ||
| - Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed. | ||
| - Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans. | ||
| - Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources. | ||
| - Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish. | ||
| - If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts. | ||
| - Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart. | ||
|
|
||
| ## CIS Kubernetes Benchmark support | ||
|
|
||
| | Source | Kubernetes distribution | scan profile | Kubernetes versions | | ||
| |--------|-------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------| | ||
| | CIS | any | [cis-1.7](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.7) | v1.25 | | ||
| | CIS | any | [cis-1.8](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.8) | v1.26+ | | ||
| | CIS | rke | [rke-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-permissive) | rke1-v1.25 | | ||
| | CIS | rke | [rke-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-hardened) | rke1-v1.25 | | ||
| | CIS | rke | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+ | | ||
| | CIS | rke | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+ | | ||
| | CIS | rke2 | [rke2-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-permissive)| rke2-v1.25 | | ||
| | CIS | rke2 | [rke2-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-hardened) | rke2-v1.25 | | ||
| | CIS | rke2 | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-permissive)| rke2-v1.26+ | | ||
| | CIS | rke2 | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+ | | ||
| | CIS | k3s | [k3s-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-permissive) | k3s-v1.25 | | ||
| | CIS | k3s | [k3s-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-hardened) | k3s-v1.25 | | ||
| | CIS | k3s | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+ | | ||
| | CIS | k3s | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+ | | ||
| | CIS | eks | eks-1.2.0 | eks | | ||
| | CIS | aks | aks-1.0 | aks | | ||
| | CIS | gke | gke-1.2.0 | gke | |
27 changes: 27 additions & 0 deletions
27
charts/rancher-cis-benchmark/6.3.0-rc.1/templates/_helpers.tpl
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| {{/* Ensure namespace is set the same everywhere */}} | ||
| {{- define "cis.namespace" -}} | ||
| {{- .Release.Namespace | default "cis-operator-system" -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "system_default_registry" -}} | ||
| {{- if .Values.global.cattle.systemDefaultRegistry -}} | ||
| {{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} | ||
| {{- else -}} | ||
| {{- "" -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Windows cluster will add default taint for linux nodes, | ||
| add below linux tolerations to workloads could be scheduled to those linux nodes | ||
| */}} | ||
| {{- define "linux-node-tolerations" -}} | ||
| - key: "cattle.io/os" | ||
| value: "linux" | ||
| effect: "NoSchedule" | ||
| operator: "Equal" | ||
| {{- end -}} | ||
|
|
||
| {{- define "linux-node-selector" -}} | ||
| kubernetes.io/os: linux | ||
| {{- end -}} |
Oops, something went wrong.