Files
rancher-docs/zh/pages-for-subheaders/cis-scans.html
T

24 lines
27 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="zh" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-pages-for-subheaders/cis-scans">
<head>
<meta charset="UTF-8">
<meta name="generator" content="Docusaurus v2.2.0">
<title data-rh="true">CIS 扫描 | Rancher Manager</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/cis-scans"><meta data-rh="true" name="docusaurus_locale" content="zh"><meta data-rh="true" name="docsearch:language" content="zh"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="CIS 扫描 | Rancher Manager"><meta data-rh="true" name="description" content="Rancher 可以通过运行安全扫描来检查 Kubernetes 是否按照 CIS Kubernetes Benchmark 中定义的安全最佳实践进行部署。CIS 扫描可以运行在任何 Kubernetes 集群,包括托管的 Kubernetes,例如 EKS、AKS 和 GKE。"><meta data-rh="true" property="og:description" content="Rancher 可以通过运行安全扫描来检查 Kubernetes 是否按照 CIS Kubernetes Benchmark 中定义的安全最佳实践进行部署。CIS 扫描可以运行在任何 Kubernetes 集群,包括托管的 Kubernetes,例如 EKS、AKS 和 GKE。"><link data-rh="true" rel="icon" href="/zh/img/favicon.png"><link data-rh="true" rel="canonical" href="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/cis-scans"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/cis-scans" hreflang="en"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/cis-scans" hreflang="zh"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/cis-scans" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="search" type="application/opensearchdescription+xml" title="Rancher Manager" href="/zh/opensearch.xml">
<!-- Google Tag Manager -->
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
<!-- End Google Tag Manager -->
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/zh/assets/css/styles.19303192.css">
<link rel="preload" href="/zh/assets/js/runtime~main.ee5c32f6.js" as="script">
<link rel="preload" href="/zh/assets/js/main.bc269412.js" as="script">
</head>
<body class="navigation-with-keyboard">
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region" aria-label="跳到主要内容"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">跳到主要内容</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/zh/"><div class="navbar__logo"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/zh/">v2.7</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/zh/pages-for-subheaders/cis-scans">v2.7</a></li><li><a class="dropdown__link" href="/zh/v2.6/pages-for-subheaders/cis-scans">v2.6</a></li><li><a class="dropdown__link" href="/zh/v2.5/pages-for-subheaders/cis-scans">v2.5</a></li><li><a class="dropdown__link" href="/zh/v2.0-v2.4/pages-for-subheaders/cis-scans">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/zh/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>简体中文</a><ul class="dropdown__menu"><li><a href="/pages-for-subheaders/cis-scans" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="en">English</a></li><li><a href="/zh/pages-for-subheaders/cis-scans" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="搜索"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">搜索</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="回到顶部" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/">什么是 Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/getting-started/overview">开始使用</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/pages-for-subheaders/new-user-guides">操作指南</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/pages-for-subheaders/best-practices">参考指南</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/zh/pages-for-subheaders/cloud-marketplace">Rancher 中的集成</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cloud-marketplace">云市场集成</a><button aria-label="打开/收起侧边栏菜单「云市场集成」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible menu__list-item-collapsible--active"><a class="menu__link menu__link--sublist menu__link--active" aria-current="page" aria-expanded="true" tabindex="0" href="/zh/pages-for-subheaders/cis-scans">CIS 扫描</a><button aria-label="打开/收起侧边栏菜单「CIS 扫描」" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/cis-scans/configuration-reference">配置</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/cis-scans/rbac-for-cis-scans">RBAC</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests">跳过和不适用的测试</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/cis-scans/custom-benchmark">为集群扫描创建自定义 Benchmark 版本</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/fleet-gitops-at-scale">Fleet - 大规模的 GitOps</a><button aria-label="打开/收起侧边栏菜单「Fleet - 大规模的 GitOps」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/harvester">Harvester 集成</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/istio">Istio</a><button aria-label="打开/收起侧边栏菜单「Istio」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/longhorn">Longhorn - Kubernetes 的云原生分布式块存储</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/logging">Logging</a><button aria-label="打开/收起侧边栏菜单「Logging」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/monitoring-and-alerting">监控和告警</a><button aria-label="打开/收起侧边栏菜单「监控和告警」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/neuvector">NeuVector 集成</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/opa-gatekeeper">OPA Gatekeeper</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/integrations-in-rancher/rancher-extensions">Rancher 扩展</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/faq/general-faq">常见问题</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/troubleshooting/general-troubleshooting">故障排除</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/contribute-to-rancher">参与 Rancher 社区贡献</a></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="页面路径"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="主页面" class="breadcrumbs__link" href="/zh/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Rancher 中的集成</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">CIS 扫描</span><meta itemprop="position" content="2"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">版本:v2.7</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">本页总览</button></div><div class="theme-doc-markdown markdown"><header><h1>CIS 扫描</h1></header><p>Rancher 可以通过运行安全扫描来检查 Kubernetes 是否按照 CIS Kubernetes Benchmark 中定义的安全最佳实践进行部署。CIS 扫描可以运行在任何 Kubernetes 集群,包括托管的 Kubernetes,例如 EKS、AKS 和 GKE。</p><p><code>rancher-cis-benchmark</code> 应用使用了 <a href="https://github.com/aquasecurity/kube-bench" target="_blank" rel="noopener noreferrer">kube-bench</a> ,这是 Aqua Security 的开源工具,用于检查集群是否符合 CIS Kubernetes Benchmark。此外,为了生成集群级别的报告,此应用使用了 <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank" rel="noopener noreferrer">Sonobuoy</a> 来聚合报告。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="关于-cis-benchmark">关于 CIS Benchmark<a class="hash-link" href="#关于-cis-benchmark" title="标题的直接链接">​</a></h2><p>CIS(Center for Internet Security)是一个 501(c<!-- -->)<!-- -->(3) 非营利组织,成立于 2000 年 10 月,其使命是识别、开发、验证、促进和维持网络防御的最佳实践方案,并建立和指导社区,以在网络空间中营造信任的环境。该组织总部位于纽约东格林布什,其成员包括大公司、政府机构和学术机构。</p><p>CIS Benchmark 是目标系统安全配置的最佳实践。CIS Benchmark 是由安全专家、技术供应商、公开和私人社区成员,以及 CIS Benchmark 开发团队共同志愿开发的。</p><p>你可以访问 CIS 网站获取官方的 Benchmark 文件。要通过注册来访问文件,请前往</p><a href="https://learn.cisecurity.org/benchmarks" target="_blank" rel="noopener noreferrer">这里</a>。<h2 class="anchor anchorWithStickyNavbar_LWe7" id="关于生成的报告">关于生成的报告<a class="hash-link" href="#关于生成的报告" title="标题的直接链接">​</a></h2><p>每次扫描都会生成一份报告,你可以在 Rancher UI 中查看该报告,并以 CSV 格式下载它。</p><p>默认情况下使用 CIS Benchmark v1.6。</p><p>Benchmark 版本包含在生成的报告中。</p><p>Benchmark 提供两种类型的建议,分别是自动(Automated)和手动(Manual)。Benchmark 中标记为 Manual 的建议不包含在生成的报告中。</p><p>一些测试会被标记为“不适用”。由于 Rancher 配置 RKE 集群的方式,这些测试不会在任何 CIS 扫描中运行。有关如何审核测试结果,以及为什么某些测试会被标记为不适用,请参阅 Rancher 的 Kubernetes 对应版本的<a href="/zh/pages-for-subheaders/rancher-security#cis-benchmark-%E5%92%8C%E8%87%AA%E6%88%91%E8%AF%84%E4%BC%B0">自测指南</a>。</p><p>该报告包含以下信息:</p><table><thead><tr><th>报告中的列</th><th>描述</th></tr></thead><tbody><tr><td><code>id</code></td><td>CIS Benchmark 的 ID 号。</td></tr><tr><td><code>description</code></td><td>CIS Benchmark 测试的描述。</td></tr><tr><td><code>remediation</code></td><td>为了通过测试需要修复的内容。</td></tr><tr><td><code>state</code></td><td>测试的状态,可以是通过、失败、跳过或不适用。</td></tr><tr><td><code>node_type</code></td><td>节点角色,角色决定了在节点上运行的测试。主测试在 controlplane 节点上运行,etcd 测试在 etcd 节点上运行,节点测试在 Worker 节点上运行。</td></tr><tr><td><code>audit</code></td><td>这是 <code>kube-bench</code> 为此测试运行的审计检查。</td></tr><tr><td><code>audit_config</code></td><td>适用于审计脚本的任何配置。</td></tr><tr><td><code>test_info</code></td><td><code>kube-bench</code> 报告的测试相关信息(如果存在)。</td></tr><tr><td><code>commands</code></td><td><code>kube-bench</code> 报告的测试相关的命令(如果存在)。</td></tr><tr><td><code>config_commands</code></td><td><code>kube-bench</code> 报告的测试相关的配置数据(如果存在)。</td></tr><tr><td><code>actual_value</code></td><td>测试的实际值。如果由 <code>kube-bench</code> 报告,则会显示。</td></tr><tr><td><code>expected_result</code></td><td>测试的预期值。如果由 <code>kube-bench</code> 报告,则会显示。</td></tr></tbody></table><p>请参阅<a href="/zh/pages-for-subheaders/rancher-security">集群加固指南中的表格</a>,以了解 Kubernetes、Benchmark、Rancher 以及我们的集群强化指南的版本对应关系。另外,请参阅强化指南,以获取符合 CIS 的集群的配置文件以及修复失败测试的信息。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="测试配置文件">测试配置文件<a class="hash-link" href="#测试配置文件" title="标题的直接链接">​</a></h2><p>以下是可用的配置文件:</p><ul><li>Generic CIS 1.5</li><li>Generic CIS 1.6</li><li>RKE permissive 1.5</li><li>RKE hardened 1.5</li><li>RKE permissive 1.6</li><li>RKE hardened 1.6</li><li>RKE2 permissive 1.5</li><li>RKE2 hardened 1.5</li><li>RKE2 permissive 1.6</li><li>RKE2 hardened 1.6</li><li>AKS</li><li>EKS</li><li>GKE</li></ul><p>你还可以通过保存一组要跳过的测试来自定义配置文件。</p><p>所有配置文件都会有一组不适用的测试,CIS 扫描会跳过这些测试。RKE 集群管理 Kubernetes 的方式导致这些测试被认为不适用。</p><p>RKE 集群扫描配置文件有两种类型:</p><ul><li><strong>Permissive</strong>:此配置文件有一组要跳过的测试,跳过的原因是这些测试会在默认的 RKE Kubernetes 集群上失败。除了跳过的测试列表之外,配置文件也不会运行不适用的测试。</li><li><strong>Hardened</strong>:此配置文件不会跳过任何测试(不适用的测试除外)。</li></ul><p>EKS 和 GKE 集群扫描的配置文件基于这些集群类型特定的 CIS Benchmark 版本。</p><p>要通过 “Hardened” 配置文件,你需要遵从<a href="/zh/pages-for-subheaders/rancher-security#rancher-%E5%BC%BA%E5%8C%96%E6%8C%87%E5%8D%97">强化指南</a>并使用强化指南中定义的 <code>cluster.yml</code> 来配置一个强化集群。</p><p>默认配置文件和支持的 CIS Benchmark 版本取决于扫描的集群类型:</p><p><code>rancher-cis-benchmark</code> 支持 CIS 1.6 Benchmark 版本。</p><ul><li>RKE Kubernetes 集群默认使用 RKE Permissive 1.6 配置文件。</li><li>EKS 和 GKE 有自己的 CIS Benchmark,由 <code>kube-bench</code> 发布。这些集群默认使用相应的测试配置文件。</li><li>RKE2 Kubernetes 集群默认使用 RKE2 Permissive 1.6 配置文件。</li><li>RKE、RKE2、EKS 和 GKE 以外的集群类型默认使用 Generic CIS 1.5 配置文件。</li></ul><h2 class="anchor anchorWithStickyNavbar_LWe7" id="跳过和不适用的测试">跳过和不适用的测试<a class="hash-link" href="#跳过和不适用的测试" title="标题的直接链接">​</a></h2><p>有关要跳过和不适用的测试列表,请参阅<a href="/zh/how-to-guides/advanced-user-guides/cis-scan-guides/skip-tests">此页面</a>。</p><p>目前,只有用户定义的跳过测试会在生成报告中标记为跳过。</p><p>如果某个默认配置文件将某个测试定义为跳过,则该测试也会标记为不适用。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="rbac">RBAC<a class="hash-link" href="#rbac" title="标题的直接链接">​</a></h2><p>有关权限的详细信息,请参阅<a href="/zh/integrations-in-rancher/cis-scans/rbac-for-cis-scans">此页面</a>。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="配置">配置<a class="hash-link" href="#配置" title="标题的直接链接">​</a></h2><p>有关为扫描、配置文件和 Benchmark 版本配置自定义资源的更多信息,请参阅<a href="/zh/integrations-in-rancher/cis-scans/configuration-reference">此页面</a>。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="操作指南">操作指南<a class="hash-link" href="#操作指南" title="标题的直接链接">​</a></h2><p>请参阅<a href="/zh/pages-for-subheaders/cis-scan-guides">此处</a>了解 CIS 扫描的操作指南。</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/pages-for-subheaders/cis-scans.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>编辑此页</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">最后<!-- -->于 <b><time datetime="2022-10-25T20:41:06.000Z">2022年10月25日</time></b> <!-- -->更新</span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="文档分页导航"><a class="pagination-nav__link pagination-nav__link--prev" href="/zh/integrations-in-rancher/cloud-marketplace/supportconfig"><div class="pagination-nav__sublabel">上一页</div><div class="pagination-nav__label">Supportconfig Bundle</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/zh/integrations-in-rancher/cis-scans/configuration-reference"><div class="pagination-nav__sublabel">下一页</div><div class="pagination-nav__label">配置</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#关于-cis-benchmark" class="table-of-contents__link toc-highlight">关于 CIS Benchmark</a></li><li><a href="#关于生成的报告" class="table-of-contents__link toc-highlight">关于生成的报告</a></li><li><a href="#测试配置文件" class="table-of-contents__link toc-highlight">测试配置文件</a></li><li><a href="#跳过和不适用的测试" class="table-of-contents__link toc-highlight">跳过和不适用的测试</a></li><li><a href="#rbac" class="table-of-contents__link toc-highlight">RBAC</a></li><li><a href="#配置" class="table-of-contents__link toc-highlight">配置</a></li><li><a href="#操作指南" class="table-of-contents__link toc-highlight">操作指南</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/zh/assets/js/runtime~main.ee5c32f6.js"></script>
<script src="/zh/assets/js/main.bc269412.js"></script>
<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) --></body>
</html>