First yamls and Update info
- Modify yaml versions from 1.10 to 1.11
- Adapt configmap to cover cis-1.11
- Adapt docs and cmd files
- Fix version_mapping in global configMap and common_test.go: Kuberversion for cis-1.11
- doc: improve version mapping in platforms
Adapt master.yaml
- modify: 1.1.20 https://workbench.cisecurity.org/benchmarks/19519/tickets/24017 permissions changed from 600 to 644
- create: 1.2.30 Ensure that the --service-account-extend-token-expiration parameter is set to false (Automated)
Adapt node.yaml
- Add: 4.2.14 Ensure that the --seccomp-default parameter is set to true (Manual)
- Add: 4.2.15 Ensure that the --IPAddressDeny is set to any (Manual) - this check is to be removed in CIS-1.1.12, I suggest we discard it.
- Modify: 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - (changed from 600 to 644) https://workbench.cisecurity.org/community/43/discussions/11786
- Modify: 4.2.4 Verify that if defined, readOnlyPort is set to 0 (Manual) - Added "if defined"
Adapt policies.yaml
- Modify: 5.1.1 to 5.1.6 from (Automated) to (Manual)
- Modify: section titled "General Policies" was renumbered from 5.7 in v1.10 to 5.6
* Add AKS-1.7 version
* resolve linter error
* add aks-1.7 as a default plateform aks version
* add alternative method to identify AKS specific cluster
* fix alternative method
* combine logic of label and providerId in isAKS function
* fix checks of aks-1.7
* fix the mentioned issues
* fix test cases
* Create cis-1.10 yamls and Update info
- Modify yaml versions from 1.9 to 1.10
- Adapt configmap to cover cis-1.10
- Adapt docs and cmd files
* Adapt master.yaml
- 1.2.29 update cipher list to remove the following insecure ones (RC4-Based, 3DES-Based, RSA-Based AES CBC):
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_RC4_128_SHA,
TLS_ECDHE_RSA_WITH_RC4_128_SHA
ticket: https://workbench.cisecurity.org/community/43/tickets/21760
* Adapt policies.yaml
- 5.1.11 typo in sub-resource name 'certificatesigningrequest' https://workbench.cisecurity.org/tickets/21352
- 5.2.2 new audit to verify if a container is privileged or not. https://workbench.cisecurity.org/tickets/20919
- 5.2.3 new audit to verify the presence of hostPID opt-in across all pods. https://workbench.cisecurity.org/tickets/20919
- 5.2.4 new audit to verify the presence of hostIPC opt-in across all pods. https://workbench.cisecurity.org/tickets/20923
- 5.2.5 new audit to verify the presence of hostNetwork opt-in across all pods. https://workbench.cisecurity.org/tickets/20921
- 5.2.6 new audit to verify the presence of 'allowPrivilegeEscalation' to true across all pods' container(s)
- 5.2.6 the 'allowPrivilegeEscalation' setting is moved from 'spec' to 'securityContext' https://workbench.cisecurity.org/tickets/20922
- 5.2.9 new audit to verify the presence of added capabilities across all pods' container(s)
* Fix 5.2.6 remediation
* Create cis-1.9 yamls and Update info
- policies.yaml
- 5.1.1 to 5.1.6 were adapted from Manual to Automated
- 5.1.3 got broken down into 5.1.3.1 and 5.1.3.2
- 5.1.6 got broken down into 5.1.6.1 and 5.1.6.2
- version was set to cis-1.9
- node.yaml master.yaml controlplane.yaml etcd.yaml
- version was set to cis-1.9
* Adapt master.yaml
- Expand 1.1.13/1.1.14 checks by adding super-admin.conf to the permission and ownership verification
- Remove 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)
- Adjust numbering from 1.2.12 to 1.2.29
* Adjust policies.yaml
- Check 5.2.3 to 5.2.9 Title Automated to Manual
* Append node.yaml
- Create 4.3 kube-config group
- Create 4.3.1 Ensure that the kube-proxy metrics service is bound to localhost (Automated)
* Adjust policies 5.1.3 and 5.1.6
- Merge 5.1.3.1 and 5.1.3.2 into 5.1.3 (use role_is_compliant and clusterrole_is_compliant)
- Remove 5.1.6.1 and promote 5.1.6.2 to 5.1.6 since it natively covered 5.1.6.1 artifacts
* Add kubectl dependency and update publish
- Download kubectl (build stage) based on version and architecture
- Add binary checksum verification
- Use go env GOARCH for ARCH
* feat(cis-1.6-k3s): Add support to CIS-1.6 for k3s distribution
* update(docs): change platforms and architectrue document; update(review): code review for cfg/cis-1.6-k3s;
* update(docs): recover sheet style
* fix(yaml-lint): CI/CD YAML Error
* fix: Correct the problem of command and file/directory/log not found scene
* fix(yaml-lint): CI/CD YAML Error
