public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-28 05:59:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update compliance scan documentation to reflect CIS Benchmark version 1.9

Browse Source
This commit is contained in:
Krunal Hingu
2025-07-30 21:34:28 +05:30
parent 45f812baa1
commit 0a29eb22be
8 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.12/integrations-in-rancher/compliance-scans/compliance-scans.md
+5 -5
View File
@@ -6,9 +6,9 @@ title: Compliance Scans
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans"/>
</head>
Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The Compliance scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE.
Rancher can run a security scan to check whether a cluster is deployed according to security best practices as defined in Kubernetes security benchmarks, such as the ones provided by STIG, BSI or CIS. The Compliance scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE.
The `rancher-compliance` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.
The `rancher-compliance` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check the compliance of clusters against Kubernetes Benchmarks. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.
## About the CIS Benchmark
@@ -94,11 +94,11 @@ In order to pass the "Hardened" profile, you will need to follow the steps on th
The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned:
The `rancher-compliance` supports the CIS 1.6 Benchmark version.
The `rancher-compliance` supports the CIS 1.9 Benchmark version.
- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default.
- For RKE Kubernetes clusters, the RKE Permissive 1.9 profile is the default.
- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters.
- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.6 profile is the default.
- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.9 profile is the default.
- For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default.
## About Skipped and Not Applicable Tests