[v2.8] Removed support for CIS scan profile and benchmarks for versions prior to k8s 1.25 #3721

chiukapoor · 2024-03-29T11:49:45Z

Issue:

Fixes [v2.8] CIS: remove the benchmark scan profile of deprecated k8s versions. cis-operator#289

Solution

Removed support for CIS scan profile and benchmarks for versions prior to k8s 1.25

1.20
1.23
1.24
1.5
1.6

Bump rancher-cis-benchmark to v5.2.0-rc1

github-actions · 2024-03-29T11:49:56Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

github-actions · 2024-03-29T11:52:54Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

github-actions · 2024-03-29T12:22:34Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

adamkpickering

LGTM once the merge conflicts are resolved.

github-actions · 2024-04-02T09:27:48Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

github-actions · 2024-04-02T09:52:27Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

andypitcher · 2024-04-03T20:42:44Z

charts/rancher-cis-benchmark/5.2.0-rc1/app-readme.md

+
+This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
+
+For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/).


Suggested change

For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/).

For more information on how to use the feature, refer to our [docs](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides).

Update link to latest documentation.

andypitcher · 2024-04-03T21:50:57Z

charts/rancher-cis-benchmark/5.2.0-rc1/app-readme.md

+This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
+
+For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/).
+


Suggested change

## CIS Kubernetes Benchmark support

| Source | Kubernetes distribution | scan profile | Kubernetes versions |

|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|---------------------|

| CIS | any | [cis-1.7](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.7) | v1.25 |

| CIS | any | [cis-1.8](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.8) | v1.26+ |

| CIS | rke | [rke-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-permissive) | rke1-v1.25 |

| CIS | rke | [rke-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-permissive) | rke1-v1.25 |

| CIS | rke | [rke-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-hardened) | rke1-v1.25 |

| CIS | rke | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+ |

| CIS | rke | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+ |

| CIS | rke2 | [rke2-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-permissive) | rke2-v1.25 |

| CIS | rke2 | [rke2-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-hardened) | rke2-v1.25 |

| CIS | rke2 | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-permissive) | rke2-v1.26+ |

| CIS | rke2 | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+ |

| CIS | k3s | [k3s-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-permissive) | k3s-v1.25 |

| CIS | k3s | [k3s-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-hardened) | k3s-v1.25 |

| CIS | k3s | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+ |

| CIS | k3s | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+ |

| CIS | eks | eks-1.2.0 | eks |

| CIS | aks | aks-1.0 | aks |

| CIS | gke | gke-1.2.0 | gke |

Adding more details in the chart info about supported versions, as it's done on kube-bench: https://github.com/aquasecurity/kube-bench/blob/main/docs/platforms.md .

github-actions · 2024-04-05T13:01:42Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

nicholasSUSE

Hello, we have improved the Charts documentation regarding Pull Request Rules.

Please take a look at it before making any new Pull Requests.
We are still approving Pull Requests and starting to inform all teams, soon we will require the standard in the documentation.

https://github.com/rancher/charts?tab=readme-ov-file#pull-request-rules

github-actions · 2024-04-10T11:06:27Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

github-actions · 2024-04-10T15:03:43Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

github-actions · 2024-04-11T04:36:51Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

…r to k8s 1.25 * Bump security-scan image to v0.2.15-rc2 * Bump kubectl to v1.28.7 * Add CIS Kubernetes Benchmark support matrix in readme and update the reference link to point to latest documentation Signed-off-by: Chirayu Kapoor <chirayu.kapoor@suse.com>

Signed-off-by: Chirayu Kapoor <chirayu.kapoor@suse.com>

github-actions · 2024-04-12T04:36:49Z

Validation steps

Ensure all container images have repository and tag on the same level to ensure that all container images are included in rancher-images.txt which are used by airgap customers.

  Ex:-
    longhorn-controller:
      repository: rancher/hardened-sriov-cni
      tag: v2.6.3-build20230913

Add a 👍 (thumbs up) reaction to this comment once done. CI won't pass without this reaction to the github-action bot's latest validation comment.
Approve the PR to run the CI check.

…ns prior to k8s 1.25 (#3721) Signed-off-by: Chirayu Kapoor <chirayu.kapoor@suse.com>

chiukapoor requested review from a team as code owners March 29, 2024 11:49

chiukapoor force-pushed the remove-old-k8s branch from ea951d9 to 33bd58d Compare March 29, 2024 11:52

chiukapoor force-pushed the remove-old-k8s branch from 33bd58d to 5f4f728 Compare March 29, 2024 12:22

adamkpickering approved these changes Apr 1, 2024

View reviewed changes

chiukapoor force-pushed the remove-old-k8s branch from 5f4f728 to 84082ea Compare April 2, 2024 09:25

chiukapoor requested a review from andypitcher April 2, 2024 09:50

chiukapoor force-pushed the remove-old-k8s branch from 84082ea to 8e36d98 Compare April 2, 2024 09:51

andypitcher reviewed Apr 3, 2024

View reviewed changes

chiukapoor force-pushed the remove-old-k8s branch from 8e36d98 to 311d821 Compare April 5, 2024 13:01

nicholasSUSE approved these changes Apr 8, 2024

View reviewed changes

chiukapoor force-pushed the remove-old-k8s branch from 311d821 to b73b123 Compare April 10, 2024 11:06

chiukapoor force-pushed the remove-old-k8s branch from b73b123 to bb217e8 Compare April 10, 2024 15:03

chiukapoor requested a review from andypitcher April 10, 2024 15:33

chiukapoor force-pushed the remove-old-k8s branch from bb217e8 to 9b8b455 Compare April 11, 2024 04:36

andypitcher approved these changes Apr 11, 2024

View reviewed changes

chiukapoor added 2 commits April 12, 2024 10:06

make charts

2da6ffd

Signed-off-by: Chirayu Kapoor <chirayu.kapoor@suse.com>

chiukapoor force-pushed the remove-old-k8s branch from 9b8b455 to 2da6ffd Compare April 12, 2024 04:36

vardhaman22 approved these changes Apr 12, 2024

View reviewed changes

chiukapoor merged commit 8dbd934 into rancher:dev-v2.8 Apr 12, 2024
6 checks passed

lucasmlp pushed a commit that referenced this pull request May 7, 2024

[v2.8] Removed support for CIS scan profile and benchmarks for versio…

4d5aadb

…ns prior to k8s 1.25 (#3721) Signed-off-by: Chirayu Kapoor <chirayu.kapoor@suse.com>

lucasmlp mentioned this pull request May 7, 2024

[release-v2.8] First batch release for Rancher v2.8.4 #3870

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[v2.8] Removed support for CIS scan profile and benchmarks for versions prior to k8s 1.25 #3721

[v2.8] Removed support for CIS scan profile and benchmarks for versions prior to k8s 1.25 #3721

chiukapoor commented Mar 29, 2024 •

edited

Loading

github-actions bot commented Mar 29, 2024

github-actions bot commented Mar 29, 2024

github-actions bot commented Mar 29, 2024

adamkpickering left a comment

github-actions bot commented Apr 2, 2024

github-actions bot commented Apr 2, 2024

andypitcher Apr 3, 2024

andypitcher Apr 3, 2024

github-actions bot commented Apr 5, 2024

nicholasSUSE left a comment

github-actions bot commented Apr 10, 2024

github-actions bot commented Apr 10, 2024

github-actions bot commented Apr 11, 2024

github-actions bot commented Apr 12, 2024


		This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).

		For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/cis-scans/v2.5/).

+## CIS Kubernetes Benchmark support
+| Source | Kubernetes distribution                                                                                                                                                                              | scan profile        | Kubernetes versions |
+|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|---------------------|
+| CIS    | any  | [cis-1.7](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.7) | v1.25 |
+| CIS    | any | [cis-1.8](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.8) | v1.26+ |
+| CIS    | rke  | [rke-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-permissive) | rke1-v1.25     |
+| CIS    | rke  | [rke-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-permissive) | rke1-v1.25     |
+| CIS    | rke  | [rke-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-hardened) | rke1-v1.25     |
+| CIS    | rke  | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+     |
+| CIS    | rke  | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+     |
+| CIS    | rke2  | [rke2-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-permissive) | rke2-v1.25     |
+| CIS    | rke2  | [rke2-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-hardened) | rke2-v1.25     |
+| CIS    | rke2  | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-permissive) | rke2-v1.26+     |
+| CIS    | rke2  | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+     |
+| CIS    | k3s  | [k3s-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-permissive) | k3s-v1.25     |
+| CIS    | k3s  | [k3s-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-hardened) | k3s-v1.25     |
+| CIS    | k3s  | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+     |
+| CIS    | k3s  | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+     |
+| CIS    | eks  | eks-1.2.0 | eks    |
+| CIS    | aks  | aks-1.0 | aks     |
+| CIS    | gke  | gke-1.2.0 | gke     |

[v2.8] Removed support for CIS scan profile and benchmarks for versions prior to k8s 1.25 #3721

[v2.8] Removed support for CIS scan profile and benchmarks for versions prior to k8s 1.25 #3721

Conversation

chiukapoor commented Mar 29, 2024 • edited Loading

Issue:

Solution

github-actions bot commented Mar 29, 2024

Validation steps

github-actions bot commented Mar 29, 2024

Validation steps

github-actions bot commented Mar 29, 2024

Validation steps

adamkpickering left a comment

Choose a reason for hiding this comment

github-actions bot commented Apr 2, 2024

Validation steps

github-actions bot commented Apr 2, 2024

Validation steps

andypitcher Apr 3, 2024

Choose a reason for hiding this comment

andypitcher Apr 3, 2024

Choose a reason for hiding this comment

github-actions bot commented Apr 5, 2024

Validation steps

nicholasSUSE left a comment

Choose a reason for hiding this comment

github-actions bot commented Apr 10, 2024

Validation steps

github-actions bot commented Apr 10, 2024

Validation steps

github-actions bot commented Apr 11, 2024

Validation steps

github-actions bot commented Apr 12, 2024

Validation steps

chiukapoor commented Mar 29, 2024 •

edited

Loading