added rke2 cis-1.9 templates

Author: vardhaman22

chart/app-readme.md

@@ -20,14 +20,15 @@ This chart installs the following components:
 |--------|-------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------|
 | CIS    | any                     | [cis-1.9](https://github.com/aquasecurity/kube-bench/tree/main/cfg/cis-1.9)                                                         | v1.27+              |
 | CIS    | any                     | [cis-1.8](https://github.com/aquasecurity/kube-bench/tree/main/cfg/cis-1.8)                                                         | v1.26               |
-| CIS    | rke                     | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke-cis-1.8-permissive)  | rke1-v1.26+         |
-| CIS    | rke                     | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke-cis-1.8-hardened)                  | rke1-v1.26+         |
-| CIS    | rke2                    | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.8-permissive) | rke2-v1.26+         |
-| CIS    | rke2                    | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.8-hardened)                 | rke2-v1.26+         |
-| CIS    | k3s                     | [k3s-cis-1.9](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.9)                                | k3s-v1.27+          |
-| CIS    | k3s                     | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.8-permissive)  | k3s-v1.26           |
-| CIS    | k3s                     | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.8-hardened)                  | k3s-v1.26           |
-| CIS    | eks                     | [eks-1.2.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/eks-1.2.0)                                                       | eks                 |
+| CIS    | rke                     | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke-cis-1.8-permissive)                        | rke1-v1.26+         |
+| CIS    | rke                     | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke-cis-1.8-hardened)                          | rke1-v1.26+         |
+| CIS    | rke2                    | [rke2-cis-1.9](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.9)                                              | rke2-v1.27+         |
+| CIS    | rke2                    | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.8-permissive)                       | rke2-v1.26          |
+| CIS    | rke2                    | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/rke2-cis-1.8-hardened)                         | rke2-v1.26          |
+| CIS    | k3s                     | [k3s-cis-1.9](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.9)                                               | k3s-v1.27+          |
+| CIS    | k3s                     | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.8-permissive)                        | k3s-v1.26           |
+| CIS    | k3s                     | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/release/v0.5/package/cfg/k3s-cis-1.8-hardened)                          | k3s-v1.26           |
+| CIS    | eks                     | [eks-1.2.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/eks-1.2.0)                                                         | eks                 |
 | CIS    | aks                     | [aks-1.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/aks-1.0)                                                         | aks                 |
-| CIS    | gke                     | [gke-1.2.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/gke-1.2.0)                                                       | gke-1.20            |
-| CIS    | gke                     | [gke-1.6.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/gke-1.6.0)                                                       | gke-1.29+           |
+| CIS    | gke                     | [gke-1.2.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/gke-1.2.0)                                                         | gke-1.20            |
+| CIS    | gke                     | [gke-1.6.0](https://github.com/aquasecurity/kube-bench/tree/main/cfg/gke-1.6.0)                                                         | gke-1.29+           |

chart/templates/benchmark-rke2-cis-1.8-hardened.yaml

@@ -6,3 +6,4 @@ metadata:
 spec:
   clusterProvider: rke2
   minKubernetesVersion: "1.26.0"
+  maxKubernetesVersion: "1.26.x"

chart/templates/benchmark-rke2-cis-1.8-permissive.yaml

@@ -6,3 +6,4 @@ metadata:
 spec:
   clusterProvider: rke2
   minKubernetesVersion: "1.26.0"
+  maxKubernetesVersion: "1.26.x"

chart/templates/benchmark-rke2-cis-1.9.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanBenchmark
+metadata:
+  name: rke2-cis-1.9
+spec:
+  clusterProvider: rke2
+  minKubernetesVersion: "1.27.0"

chart/templates/configmap.yaml

@@ -10,7 +10,7 @@ data:
     >=1.21.0: rke-profile-permissive-1.8
   rke2: |-
     <1.21.0: rke2-cis-1.20-profile-permissive
-    >=1.21.0: rke2-cis-1.8-profile-permissive
+    >=1.21.0: rke2-cis-1.9-profile
   eks: "eks-profile"
   gke: "gke-profile-1.6.0"
   aks: "aks-profile"

chart/templates/scanprofile-rke2-cis-1.9.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanProfile
+metadata:
+  name: rke2-cis-1.9-profile
+  annotations:
+    clusterscanprofile.cis.cattle.io/builtin: "true"
+spec:
+  benchmarkVersion: rke2-cis-1.9