Add support for CIS OpenShift 1.6 Benchmark #1682
Conversation
|
|
deebhatia
force-pushed
the
cis-openshift-1-6
branch
3 times, most recently
from
2873eea to
d2041f5
Compare
|
Hi @afdesk @mozillazg, |
|
Hi @deebhatia! |
safiyat
force-pushed
the
cis-openshift-1-6
branch
from
ac899d1 to
c8d2de5
Compare
|
Hi @afdesk, Can you please take some time out and review it? |
|
Hi @afdesk @mozillazg, a gentle reminder for review. |
deebhatia
force-pushed
the
cis-openshift-1-6
branch
from
24d527b to
b62e327
Compare
deebhatia
force-pushed
the
cis-openshift-1-6
branch
from
b62e327 to
308839d
Compare
|
@afdesk @mozillazg Please retrigger the pending CI checks. The linting issues were solved. |
|
@deebhatia This branch is out-of-date with the base branch |
@afdesk Thanks. Done. |
| - apiGroups: | ||
| - '*' | ||
| resources: | ||
| - '*' |
There was a problem hiding this comment.
The ClusterRole defined in this file grants overly broad permissions by allowing access to all API groups and resources with 'get' and 'list' verbs. This violates the principle of least privilege. It's recommended to narrow down the permissions to only the specific API groups and resources that are necessary for the application to function correctly. For example, instead of apiGroups: '*' and resources: '*', specify only the required API groups and resources.
| "--benchmark", | ||
| "rh-1.6", | ||
| ] | ||
| image: docker.io/aquasec/kube-bench:latest |
There was a problem hiding this comment.
It seems that job-ocp.yaml cannot use the specified image directly, as it relies on the oc command, which is not available in docker.io/aquasec/kube-bench:latest.
@afdesk should we replace the image with a placeholder like <kube-bench-image-include-oc-command> for flexibility, or update the kube-bench image to include the oc command?
There was a problem hiding this comment.
as for me, an image will be better for using. we already have Dockerfile.ubi based on registry.access.redhat.com/ubi9/ubi-minimal. maybe we can use/update it.
but the image with a placeholder will be OK too.
This adds support of CIS OpenShift 1.6 Benchmark.
Closes #1457
CIS Benchmark Link
https://workbench.cisecurity.org/benchmarks/16094
CIS Blog mentioning the OpenShift 4.15 release version
https://www.cisecurity.org/insights/blog/cis-benchmarks-july-2024-update#CISRedHatOpenShiftContainerPlatformBenchmarkv1.6.0
Sample Run
Command Used
kube-bench run --json --version ocp-4.16
Report
1_6_results.json