1
0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-17 05:19:27 +00:00
kube-bench/cfg
Andy Pitcher 7027b6b2ec
Add CIS kubernetes CIS-1.9 for k8s v1.27 - v1.29 (#1617)
* Create cis-1.9 yamls and Update info
      - policies.yaml
          - 5.1.1 to 5.1.6 were adapted from Manual to Automated
          - 5.1.3 got broken down into 5.1.3.1 and 5.1.3.2
          - 5.1.6 got broken down into 5.1.6.1 and 5.1.6.2
          - version was set to cis-1.9
       - node.yaml master.yaml controlplane.yaml etcd.yaml
          - version was set to cis-1.9

* Adapt master.yaml
    - Expand 1.1.13/1.1.14 checks by adding super-admin.conf to the permission and ownership verification
    - Remove 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)
    - Adjust numbering from 1.2.12 to 1.2.29

* Adjust policies.yaml
   - Check 5.2.3 to 5.2.9 Title Automated to Manual

* Append node.yaml
   - Create 4.3 kube-config group
   - Create 4.3.1 Ensure that the kube-proxy metrics service is bound to localhost (Automated)

* Adjust policies 5.1.3 and 5.1.6

   - Merge 5.1.3.1 and 5.1.3.2 into 5.1.3 (use role_is_compliant and clusterrole_is_compliant)
   - Remove 5.1.6.1 and promote 5.1.6.2 to 5.1.6 since it natively covered 5.1.6.1 artifacts

* Add kubectl dependency and update publish
   - Download kubectl (build stage) based on version and architecture
   - Add binary checksum verification
   - Use go env GOARCH for ARCH
2024-06-26 15:53:57 +03:00
..
ack-1.0 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
aks-1.0 Fixed typo in policies.yaml (#1113) 2022-03-13 09:27:25 +02:00
cis-1.5 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.6 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.6-k3s Fix to empty grep and other cis-1.6-k3s checks (#1352) 2023-01-13 18:06:57 +02:00
cis-1.7 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.8 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.9 Add CIS kubernetes CIS-1.9 for k8s v1.27 - v1.29 (#1617) 2024-06-26 15:53:57 +03:00
cis-1.20 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.23 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.24 Issue: The initial command produces "root:root" as its output only when the file is present. However, if the file is missing, the command will still run successfully, though the desired output of "root:root" won't be obtained. (#1538) 2023-12-18 09:10:07 +02:00
cis-1.24-microk8s fix wrong use of flag in test_items found in 4.13 and 4.14 (#1528) 2023-12-03 09:06:35 +02:00
eks-1.0.1 Fixed typo in policies.yaml (#1113) 2022-03-13 09:27:25 +02:00
eks-1.1.0 Support CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0 (#1222) 2022-09-15 09:04:54 +03:00
eks-1.2.0 support CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.2.0 (#1449) 2023-05-21 17:53:58 +03:00
eks-stig-kubernetes-v1r6 Adding eks-stig-kubernetes-v1r6 (#1266) 2022-09-14 17:40:48 +03:00
gke-1.0 Fixed typo in policies.yaml (#1113) 2022-03-13 09:27:25 +02:00
gke-1.2.0 Fixed typo in policies.yaml (#1113) 2022-03-13 09:27:25 +02:00
k3s-cis-1.7 Replace custom k3s etcd script checks with vanilla grep checks (#1601) 2024-05-20 13:47:15 +03:00
k3s-cis-1.23 Replace custom k3s etcd script checks with vanilla grep checks (#1601) 2024-05-20 13:47:15 +03:00
k3s-cis-1.24 Replace custom k3s etcd script checks with vanilla grep checks (#1601) 2024-05-20 13:47:15 +03:00
rh-0.7 Fix experimental-encryption-provider-config test on OCP 3.11 - Issue #926 (#1024) 2021-10-27 12:56:00 +03:00
rh-1.0 Currently, certain commands involve retrieving all node names or pods and then executing additional commands in a loop, resulting in a time complexity linearly proportional to the number of nodes. (#1597) 2024-04-18 09:01:17 +03:00
rke2-cis-1.7 Rancher checks correction (#1563) 2024-02-12 15:29:36 +02:00
rke2-cis-1.23 Rancher checks correction (#1563) 2024-02-12 15:29:36 +02:00
rke2-cis-1.24 Rancher checks correction (#1563) 2024-02-12 15:29:36 +02:00
rke-cis-1.7 Rancher checks correction (#1563) 2024-02-12 15:29:36 +02:00
rke-cis-1.23 Rancher checks correction (#1563) 2024-02-12 15:29:36 +02:00
rke-cis-1.24 update rke-cis-1.24 benchmarks: corrected errors and tests (#1570) 2024-02-15 11:34:31 +02:00
tkgi-1.2.53 add support VMware Tanzu(TKGI) Benchmarks v1.2.53 (#1452) 2023-06-01 16:37:50 +03:00
config.yaml Add CIS kubernetes CIS-1.9 for k8s v1.27 - v1.29 (#1617) 2024-06-26 15:53:57 +03:00