kube-bench
kube-bench copied to clipboard
bug: incorrect CIS version selection for RKE 1.28+
Description
Currently, kube-bench does not correctly determine the appropriate CIS version for RKE versions greater than 1.27. The selection logic is limited to platform.Version: 1.23-1.27: https://github.com/aquasecurity/kube-bench/blob/a38a3c5bbcd83a766e923fccf0ed3605f91885be/cmd/util.go#L522-L538
while newer versions default to predefined mappings:
Kubernetes 1.28-1.29 → CIS 1.9 Kubernetes 1.30-1.31 → CIS 1.10 https://github.com/aquasecurity/kube-bench/blob/2de22f84fc9a808d0f0737665e8e2de43feac55c/cfg/config.yaml#L284-L287
This approach may not always be accurate, and we should handle such cases more gracefully
Proposed Solution We should check for a latest CIS benchmark for the latest RKE versions.
Hey @afdesk RKE1 will be EOL in end of July 2025. The last version for RKE1 is and will be RKE-CIS-1.8, as we chose to pursue CIS only for RKE2 and K3S.