mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
refactor: move cis scans to compliance scans in rancher intergration doc
This commit is contained in:
Krunal Hingu
swastik959
+1
-1
@@ -10,4 +10,4 @@ There could be some Kubernetes cluster setups that require custom configurations
|
||||
|
||||
It is now possible to create a custom compliance version for running a cluster scan using the `rancher-compliance` application.
|
||||
|
||||
For details, see [this page.](../../../integrations-in-rancher/cis-scans/custom-benchmark.md)
|
||||
For details, see [this page.](../../../integrations-in-rancher/compliance-scans/custom-benchmark.md)
|
||||
@@ -1,52 +0,0 @@
|
||||
---
|
||||
title: Roles-based Access Control
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/rbac-for-cis-scans"/>
|
||||
</head>
|
||||
|
||||
This section describes the permissions required to use the rancher-cis-benchmark App.
|
||||
|
||||
The rancher-cis-benchmark is a cluster-admin only feature by default.
|
||||
|
||||
However, the `rancher-cis-benchmark` chart installs these two default `ClusterRoles`:
|
||||
|
||||
- cis-admin
|
||||
- cis-view
|
||||
|
||||
In Rancher, only cluster owners and global administrators have `cis-admin` access by default.
|
||||
|
||||
Note: If you were using the `cis-edit` role added in Rancher v2.5 setup, it has now been removed since
|
||||
Rancher v2.5.2 because it essentially is same as `cis-admin`. If you happen to create any clusterrolebindings
|
||||
for `cis-edit`, please update them to use `cis-admin` ClusterRole instead.
|
||||
|
||||
## Cluster-Admin Access
|
||||
|
||||
Rancher CIS Scans is a cluster-admin only feature by default.
|
||||
This means only the Rancher global admins, and the cluster’s cluster-owner can:
|
||||
|
||||
- Install/Uninstall the rancher-cis-benchmark App
|
||||
- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans
|
||||
- List the default ClusterScanBenchmarks and ClusterScanProfiles
|
||||
- Create/Edit/Delete new ClusterScanProfiles
|
||||
- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster
|
||||
- View and Download the ClusterScanReport created after the ClusterScan is complete
|
||||
|
||||
|
||||
## Summary of Default Permissions for Kubernetes Default Roles
|
||||
|
||||
The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`:
|
||||
|
||||
| ClusterRole created by chart | Default K8s ClusterRole | Permissions given with Role
|
||||
| ------------------------------| ---------------------------| ---------------------------|
|
||||
| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
|
||||
| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
|
||||
|
||||
|
||||
By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature.
|
||||
|
||||
The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources.
|
||||
|
||||
But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually.
|
||||
There is no automatic role aggregation supported for the `rancher-cis-benchmark` ClusterRoles.
|
||||
+7
-7
@@ -1,14 +1,14 @@
|
||||
---
|
||||
title: CIS Scans
|
||||
title: Compliance Scans
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans"/>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans"/>
|
||||
</head>
|
||||
|
||||
Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE.
|
||||
Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The Compliance scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE.
|
||||
|
||||
The `rancher-cis-benchmark` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.
|
||||
The `rancher-compliance` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.
|
||||
|
||||
|
||||
## About the CIS Benchmark
|
||||
@@ -94,7 +94,7 @@ In order to pass the "Hardened" profile, you will need to follow the steps on th
|
||||
|
||||
The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned:
|
||||
|
||||
The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version.
|
||||
The `rancher-compliance` supports the CIS 1.6 Benchmark version.
|
||||
|
||||
- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default.
|
||||
- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters.
|
||||
@@ -111,7 +111,7 @@ Any skipped tests that are defined as being skipped by one of the default profil
|
||||
|
||||
## Roles-based Access Control
|
||||
|
||||
For information about permissions, refer to [this page](rbac-for-cis-scans.md)
|
||||
For information about permissions, refer to [this page](rbac-for-compliance-scans.md)
|
||||
|
||||
## Configuration
|
||||
|
||||
@@ -119,4 +119,4 @@ For more information about configuring the custom resources for the scans, profi
|
||||
|
||||
## How-to Guides
|
||||
|
||||
Please refer to the [CIS Scan Guides](../../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md) to learn how to run CIS scans.
|
||||
Please refer to the [CIS Scan Guides](../../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md) to learn how to run CIS scans.
|
||||
+14
-14
@@ -3,27 +3,27 @@ title: Configuration
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/configuration-reference"/>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/configuration-reference"/>
|
||||
</head>
|
||||
|
||||
This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization.
|
||||
This configuration reference is intended to help you manage the custom resources created by the `rancher-compliance` application. These resources are used for performing compliance scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization.
|
||||
|
||||
To configure the custom resources, go to the **Cluster Dashboard** To configure the CIS scans,
|
||||
To configure the custom resources, go to the **Cluster Dashboard** To configure the compliance scans,
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, go to the cluster where you want to configure CIS scans and click **Explore**.
|
||||
1. In the left navigation bar, click **CIS Benchmark**.
|
||||
1. On the **Clusters** page, go to the cluster where you want to configure compliance scans and click **Explore**.
|
||||
1. In the left navigation bar, click **Compliance**.
|
||||
|
||||
## Scans
|
||||
|
||||
A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed.
|
||||
A scan is created to trigger a compliance scan on the cluster based on the defined profile. A report is created after the scan is completed.
|
||||
|
||||
When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive.
|
||||
|
||||
An example ClusterScan custom resource is below:
|
||||
|
||||
```yaml
|
||||
apiVersion: cis.cattle.io/v1
|
||||
apiVersion: compliance.cattle.io/v1
|
||||
kind: ClusterScan
|
||||
metadata:
|
||||
name: rke-cis
|
||||
@@ -33,11 +33,11 @@ spec:
|
||||
|
||||
## Profiles
|
||||
|
||||
A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark.
|
||||
A profile contains the configuration for the compliance scan, which includes the benchmark version to use and any specific tests to skip in that benchmark.
|
||||
|
||||
:::caution
|
||||
|
||||
By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default ClusterScanProfiles.
|
||||
By default, a few ClusterScanProfiles are installed as part of the `rancher-compliance` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default ClusterScanProfiles.
|
||||
|
||||
:::
|
||||
|
||||
@@ -50,12 +50,12 @@ When you create a new profile, you will also need to give it a name.
|
||||
An example `ClusterScanProfile` is below:
|
||||
|
||||
```yaml
|
||||
apiVersion: cis.cattle.io/v1
|
||||
apiVersion: compliance.cattle.io/v1
|
||||
kind: ClusterScanProfile
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: clusterscan-operator
|
||||
meta.helm.sh/release-namespace: cis-operator-system
|
||||
meta.helm.sh/release-namespace: compliance-operator-system
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
name: "<example-profile>"
|
||||
@@ -70,7 +70,7 @@ spec:
|
||||
|
||||
A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark.
|
||||
|
||||
A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool.
|
||||
A `ClusterScanBenchmark` defines the Compliance `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool.
|
||||
|
||||
By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile.
|
||||
|
||||
@@ -89,12 +89,12 @@ A ClusterScanBenchmark consists of the fields:
|
||||
An example `ClusterScanBenchmark` is below:
|
||||
|
||||
```yaml
|
||||
apiVersion: cis.cattle.io/v1
|
||||
apiVersion: compliance.cattle.io/v1
|
||||
kind: ClusterScanBenchmark
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: clusterscan-operator
|
||||
meta.helm.sh/release-namespace: cis-operator-system
|
||||
meta.helm.sh/release-namespace: compliance-operator-system
|
||||
creationTimestamp: "2020-08-28T18:18:07Z"
|
||||
generation: 1
|
||||
labels:
|
||||
+7
-7
@@ -3,15 +3,15 @@ title: Creating a Custom Benchmark Version for Running a Cluster Scan
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/custom-benchmark"/>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/custom-benchmark"/>
|
||||
</head>
|
||||
|
||||
Each Benchmark Version defines a set of test configuration files that define the CIS tests to be run by the <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench</a> tool.
|
||||
The `rancher-cis-benchmark` application installs a few default Benchmark Versions which are listed under CIS Benchmark application menu.
|
||||
Each Benchmark Version defines a set of test configuration files that define the Compliance tests to be run by the <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench</a> tool.
|
||||
The `rancher-compliance` application installs a few default Benchmark Versions which are listed under Compliance application menu.
|
||||
|
||||
But there could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them.
|
||||
|
||||
It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application.
|
||||
It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-compliance` application.
|
||||
|
||||
When a cluster scan is run, you need to select a Profile which points to a specific Benchmark Version.
|
||||
|
||||
@@ -46,7 +46,7 @@ To prepare a custom benchmark version ConfigMap, suppose we want to add a custom
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**.
|
||||
1. In the left navigation bar, click **CIS Benchmark > Benchmark Version**.
|
||||
1. In the left navigation bar, click **Compliance > Benchmark Version**.
|
||||
1. Click **Create**.
|
||||
1. Enter the **Name** and a description for your custom benchmark version.
|
||||
1. Choose the cluster provider that your benchmark version applies to.
|
||||
@@ -60,7 +60,7 @@ To run a scan using your custom benchmark version, you need to add a new Profile
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**.
|
||||
1. In the left navigation bar, click **CIS Benchmark > Profile**.
|
||||
1. In the left navigation bar, click **Compliance > Profile**.
|
||||
1. Click **Create**.
|
||||
1. Provide a **Name** and description. In this example, we name it `foo-profile`.
|
||||
1. Choose the Benchmark Version from the dropdown.
|
||||
@@ -74,7 +74,7 @@ To run a scan,
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**.
|
||||
1. In the left navigation bar, click **CIS Benchmark > Scan**.
|
||||
1. In the left navigation bar, click **Compliance > Scan**.
|
||||
1. Click **Create**.
|
||||
1. Choose the new cluster scan profile.
|
||||
1. Click **Create**.
|
||||
@@ -0,0 +1,48 @@
|
||||
---
|
||||
title: Roles-based Access Control
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/rbac-for-compliance-scans"/>
|
||||
</head>
|
||||
|
||||
This section describes the permissions required to use the rancher-compliance App.
|
||||
|
||||
The rancher-compliance is a cluster-admin only feature by default.
|
||||
|
||||
However, the `rancher-compliance` chart installs these two default `ClusterRoles`:
|
||||
|
||||
- compliance-admin
|
||||
- compliance-view
|
||||
|
||||
In Rancher, only cluster owners and global administrators have `compliance-admin` access by default.
|
||||
|
||||
## Cluster-Admin Access
|
||||
|
||||
Rancher Compliance Scans is a cluster-admin only feature by default.
|
||||
This means only the Rancher global admins, and the cluster’s cluster-owner can:
|
||||
|
||||
- Install/Uninstall the rancher-compliance App
|
||||
- See the navigation links for Compliance CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans
|
||||
- List the default ClusterScanBenchmarks and ClusterScanProfiles
|
||||
- Create/Edit/Delete new ClusterScanProfiles
|
||||
- Create/Edit/Delete a new ClusterScan to run the Compliance scan on the cluster
|
||||
- View and Download the ClusterScanReport created after the ClusterScan is complete
|
||||
|
||||
|
||||
## Summary of Default Permissions for Kubernetes Default Roles
|
||||
|
||||
The rancher-compliance creates three `ClusterRoles` and adds the Compliance CRD access to the following default K8s `ClusterRoles`:
|
||||
|
||||
| ClusterRole created by chart | Default K8s ClusterRole | Permissions given with Role
|
||||
| ------------------------------| ---------------------------| ---------------------------|
|
||||
| `compliance-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
|
||||
| `compliance-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
|
||||
|
||||
|
||||
By default only cluster-owner role will have ability to manage and use `rancher-compliance` feature.
|
||||
|
||||
The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-compliance resources.
|
||||
|
||||
But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above Compliance ClusterRoles manually.
|
||||
There is no automatic role aggregation supported for the `rancher-compliance` ClusterRoles.
|
||||
+1
-1
@@ -3,7 +3,7 @@ title: Skipped and Not Applicable Tests
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests"/>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/skipped-and-not-applicable-tests"/>
|
||||
</head>
|
||||
|
||||
This section lists the tests that are skipped in the permissive test profile for RKE.
|
||||
+14
-2
@@ -1628,8 +1628,20 @@ module.exports = {
|
||||
to: "/how-to-guides/advanced-user-guides/compliance-scan-guides/create-a-custom-compliance-version-to-run",
|
||||
},
|
||||
{
|
||||
from: "/how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides",
|
||||
to: "/how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides",
|
||||
from: "/integrations-in-rancher/cis-scans/configuration-reference",
|
||||
to: "/integrations-in-rancher/compliance-scans/configuration-reference",
|
||||
},
|
||||
{
|
||||
from: "/integrations-in-rancher/cis-scans/rbac-for-cis-scans",
|
||||
to: "/integrations-in-rancher/compliance-scans/rbac-for-compliance-scans",
|
||||
},
|
||||
{
|
||||
from: "/integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests",
|
||||
to: "/integrations-in-rancher/compliance-scans/skipped-and-not-applicable-tests",
|
||||
},
|
||||
{
|
||||
from: "/integrations-in-rancher/cis-scans/custom-benchmark",
|
||||
to: "/integrations-in-rancher/compliance-scans/custom-benchmark",
|
||||
},
|
||||
],
|
||||
},
|
||||
|
||||
+6
-6
@@ -1196,16 +1196,16 @@ const sidebars = {
|
||||
},
|
||||
{
|
||||
type: "category",
|
||||
label: "CIS Scans",
|
||||
label: "Compliance Scans",
|
||||
link: {
|
||||
type: "doc",
|
||||
id: "integrations-in-rancher/cis-scans/cis-scans",
|
||||
id: "integrations-in-rancher/compliance-scans/compliance-scans",
|
||||
},
|
||||
items: [
|
||||
"integrations-in-rancher/cis-scans/configuration-reference",
|
||||
"integrations-in-rancher/cis-scans/rbac-for-cis-scans",
|
||||
"integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests",
|
||||
"integrations-in-rancher/cis-scans/custom-benchmark",
|
||||
"integrations-in-rancher/compliance-scans/configuration-reference",
|
||||
"integrations-in-rancher/compliance-scans/rbac-for-compliance-scans",
|
||||
"integrations-in-rancher/compliance-scans/skipped-and-not-applicable-tests",
|
||||
"integrations-in-rancher/compliance-scans/custom-benchmark",
|
||||
],
|
||||
},
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user