Add latest CIS benchmarks #1484

damejeras · 2023-08-09T11:51:59Z

I copied latest AKS(1.0.0), EKS(1.2.0), GKE(1.2.0) config files and adjusted them to match latest published CIS benchmarks (AKS 1.3, EKS 1.3, GKE 1.4).

EKS changes:

4.5 was removed (was previously empty), 4.6.* became 4.5.*
3.2.6 was removed and everything shifted

GKE changes:

3.2.6 was removed and everything shifted
previously 3.2.9, now is 3.2.9 and its about event record qps. 0 qps can ddos cluster, so 5 or higher is recommended.
5.5.4 added “When creating New Clusters - ” prefix to rule name

AKS changes:

3.2.6 was removed and everything shifted in 3.2.*

CLAassistant · 2023-08-09T11:52:11Z

All committers have signed the CLA.

chen-keinan · 2023-11-13T06:39:40Z

@damejeras lets wait for @mozillazg review

chen-keinan · 2023-11-13T06:41:24Z

@damejeras please rebase your branch with upstream

mozillazg · 2023-11-13T14:27:17Z

I will complete the review before next Monday.

mozillazg

Thanks for your contribution! I've added some comments. Please check them when you get a chance. Thanks!

cfg/aks-1.3/policies.yaml

cfg/eks-1.3.0/node.yaml

cfg/eks-1.3.0/policies.yaml

cfg/gke-1.4.0/managedservices.yaml

Bumps alpine from 3.18.2 to 3.18.3. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ity#1495) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 4 to 5. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@v4...v5) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps golang from 1.20.6 to 1.21.1. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…urity#1499) Bumps [crazy-max/ghaction-docker-meta](https://github.com/crazy-max/ghaction-docker-meta) from 4 to 5. - [Release notes](https://github.com/crazy-max/ghaction-docker-meta/releases) - [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md) - [Commits](docker/metadata-action@v4...v5) --- updated-dependencies: - dependency-name: crazy-max/ghaction-docker-meta dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>

Signed-off-by: chenk <hen.keinan@gmail.com>

…1498) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4 to 5. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v4...v5) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: chenk <hen.keinan@gmail.com>

Signed-off-by: chenk <hen.keinan@gmail.com>

…1503) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2 to 3. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@v2...v3) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: chenk <hen.keinan@gmail.com>

…urity#1489) Bumps [github.com/golang/glog](https://github.com/golang/glog) from 1.0.0 to 1.1.2. - [Release notes](https://github.com/golang/glog/releases) - [Commits](golang/glog@v1.0.0...v1.1.2) --- updated-dependencies: - dependency-name: github.com/golang/glog dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: chenk <hen.keinan@gmail.com>

Bumps golang from 1.21.1 to 1.21.3. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: chenk <hen.keinan@gmail.com>

…ecurity#1520) Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.14.1 to 1.16.0. - [Release notes](https://github.com/fatih/color/releases) - [Commits](fatih/color@v1.14.1...v1.16.0) --- updated-dependencies: - dependency-name: github.com/fatih/color dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…quasecurity#1510)

mozillazg · 2023-11-24T14:48:54Z

@damejeras LGTM. Would you please fix the linter error? Thanks!

mozillazg · 2023-12-03T03:40:43Z

@damejeras ping~

stephaneetje · 2024-03-14T09:02:19Z

Hello,
Any news on this ? I have to add since that PR, gke 1.5.0 got out.

kahirokunn · 2024-04-12T08:06:34Z

LGTM

afdesk · 2024-10-15T08:40:18Z

@damejeras @mozillazg hi guys!
if this PR is still OK, I can take a look and fix linter errors.
wdyt?

mozillazg · 2024-10-15T13:58:34Z

@damejeras @mozillazg hi guys! if this PR is still OK, I can take a look and fix linter errors. wdyt?

@afdesk It's ok to continue.

afdesk · 2024-10-21T09:39:48Z

@damejeras it seems I have no permissions to fix it.
Could you update the PR?
thanks for your contribution!

Add latest CIS benchmarks

651f12d

chen-keinan requested a review from mozillazg November 12, 2023 09:33

mozillazg requested changes Nov 18, 2023

View reviewed changes

dependabot bot and others added 17 commits November 20, 2023 15:12

updates to the readme

54f5b97

Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>

release: prepare v0.6.18-rc (aquasecurity#1508)

25dbe60

Signed-off-by: chenk <hen.keinan@gmail.com>

release: prepare v0.6.18 (aquasecurity#1509)

96f1370

Signed-off-by: chenk <hen.keinan@gmail.com>

release: prepare-0.6.19 (aquasecurity#1511)

0c7e481

Signed-off-by: chenk <hen.keinan@gmail.com>

feat(cis-1.24-microk8s): Add support to CIS-1.24 for microk8s distro (a…

53bc122

…quasecurity#1510)

Update new cis configurations

865ce7c

Update EKS 1.3 benchmark

d1c2c07

Merge branch 'official' into newcis

ddba985

damejeras requested a review from mozillazg November 20, 2023 13:31

hanneshofmann mentioned this pull request May 24, 2024

Support for EKS CIS benchmark 1.4.0 #1620

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add latest CIS benchmarks #1484

Add latest CIS benchmarks #1484

damejeras commented Aug 9, 2023 •

edited

Loading

CLAassistant commented Aug 9, 2023 •

edited

Loading

chen-keinan commented Nov 13, 2023

chen-keinan commented Nov 13, 2023

mozillazg commented Nov 13, 2023

mozillazg left a comment

mozillazg commented Nov 24, 2023

mozillazg commented Dec 3, 2023

stephaneetje commented Mar 14, 2024

kahirokunn commented Apr 12, 2024

afdesk commented Oct 15, 2024

mozillazg commented Oct 15, 2024

afdesk commented Oct 21, 2024

Add latest CIS benchmarks #1484

Are you sure you want to change the base?

Add latest CIS benchmarks #1484

Conversation

damejeras commented Aug 9, 2023 • edited Loading

CLAassistant commented Aug 9, 2023 • edited Loading

chen-keinan commented Nov 13, 2023

chen-keinan commented Nov 13, 2023

mozillazg commented Nov 13, 2023

mozillazg left a comment

Choose a reason for hiding this comment

mozillazg commented Nov 24, 2023

mozillazg commented Dec 3, 2023

stephaneetje commented Mar 14, 2024

kahirokunn commented Apr 12, 2024

afdesk commented Oct 15, 2024

mozillazg commented Oct 15, 2024

afdesk commented Oct 21, 2024

damejeras commented Aug 9, 2023 •

edited

Loading

CLAassistant commented Aug 9, 2023 •

edited

Loading