kube-bench icon indicating copy to clipboard operation
kube-bench copied to clipboard

bug: incorrect CIS version selection for RKE 1.28+

Open afdesk opened this issue 9 months ago • 1 comments

Description

Currently, kube-bench does not correctly determine the appropriate CIS version for RKE versions greater than 1.27. The selection logic is limited to platform.Version: 1.23-1.27: https://github.com/aquasecurity/kube-bench/blob/a38a3c5bbcd83a766e923fccf0ed3605f91885be/cmd/util.go#L522-L538

while newer versions default to predefined mappings:

Kubernetes 1.28-1.29 → CIS 1.9 Kubernetes 1.30-1.31 → CIS 1.10 https://github.com/aquasecurity/kube-bench/blob/2de22f84fc9a808d0f0737665e8e2de43feac55c/cfg/config.yaml#L284-L287

This approach may not always be accurate, and we should handle such cases more gracefully

Proposed Solution We should check for a latest CIS benchmark for the latest RKE versions.

afdesk avatar Feb 24 '25 07:02 afdesk

Hey @afdesk RKE1 will be EOL in end of July 2025. The last version for RKE1 is and will be RKE-CIS-1.8, as we chose to pursue CIS only for RKE2 and K3S.

andypitcher avatar Mar 07 '25 09:03 andypitcher