feat: update CIS operator to v1.4.3 and add benchmarks for k3s and rke2 CIS 1.11

chart/Chart.yaml

@@ -12,11 +12,11 @@ annotations:
   catalog.cattle.io/type: cluster-tool
   catalog.cattle.io/ui-component: rancher-cis-benchmark
 apiVersion: v1
-appVersion: v8.2.0
+appVersion: v8.3.0-rc.1
 description: The cis-operator enables running CIS benchmark security scans on a kubernetes
   cluster
 icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
 keywords:
 - security
 name: rancher-cis-benchmark
-version: 8.2.0
+version: 8.3.0-rc.1

chart/templates/benchmark-cis-1.10.yaml

@@ -5,4 +5,5 @@ metadata:
   name: cis-1.10
 spec:
   clusterProvider: ""
-  minKubernetesVersion: "1.28.0"
+  minKubernetesVersion: "1.28.0"
+  maxKubernetesVersion: "1.28.x"

chart/templates/benchmark-cis-1.11.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanBenchmark
+metadata:
+  name: cis-1.11
+spec:
+  clusterProvider: ""
+  minKubernetesVersion: "1.29.0"

chart/templates/benchmark-k3s-cis-1.10.yaml

@@ -5,4 +5,5 @@ metadata:
   name: k3s-cis-1.10
 spec:
   clusterProvider: k3s
-  minKubernetesVersion: "1.28.0"
+  minKubernetesVersion: "1.28.0"
+  maxKubernetesVersion: "1.28.x"

chart/templates/benchmark-k3s-cis-1.11.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanBenchmark
+metadata:
+  name: k3s-cis-1.11
+spec:
+  clusterProvider: k3s
+  minKubernetesVersion: "1.29.0"

chart/templates/benchmark-rke2-cis-1.10.yaml

@@ -5,4 +5,5 @@ metadata:
   name: rke2-cis-1.10
 spec:
   clusterProvider: rke2
-  minKubernetesVersion: "1.28.0"
+  minKubernetesVersion: "1.28.0"
+  maxKubernetesVersion: "1.28.x"

chart/templates/benchmark-rke2-cis-1.11.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanBenchmark
+metadata:
+  name: rke2-cis-1.11
+spec:
+  clusterProvider: rke2
+  minKubernetesVersion: "1.29.0"

chart/templates/configmap.yaml

@@ -10,9 +10,9 @@ data:
     >=1.21.0: rke-profile-permissive-1.8
   rke2: |-
     <1.21.0: rke2-cis-1.20-profile-permissive
-    >=1.21.0: rke2-cis-1.10-profile
+    >=1.21.0: rke2-cis-1.11-profile
   eks: "eks-profile-1.5.0"
   gke: "gke-profile-1.6.0"
   aks: "aks-profile"
-  k3s: "k3s-cis-1.10-profile"
-  default: "cis-1.10-profile"
+  k3s: "k3s-cis-1.11-profile"
+  default: "cis-1.11-profile"

chart/templates/scanprofile-cis-1.11.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanProfile
+metadata:
+  name: cis-1.11-profile
+  annotations:
+    clusterscanprofile.cis.cattle.io/builtin: "true"
+spec:
+  benchmarkVersion: cis-1.11

chart/templates/scanprofile-k3s-cis-1.11.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanProfile
+metadata:
+  name: k3s-cis-1.11-profile
+  annotations:
+    clusterscanprofile.cis.cattle.io/builtin: "true"
+spec:
+  benchmarkVersion: k3s-cis-1.11

chart/templates/scanprofile-rke2-cis-1.11.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanProfile
+metadata:
+  name: rke2-cis-1.11-profile
+  annotations:
+    clusterscanprofile.cis.cattle.io/builtin: "true"
+spec:
+  benchmarkVersion: rke2-cis-1.11

chart/values.yaml

@@ -5,10 +5,10 @@
 image:
   cisoperator:
     repository: rancher/cis-operator
-    tag: v1.4.2
+    tag: v1.4.3-rc.1
   securityScan:
     repository: rancher/security-scan
-    tag: v0.6.2
+    tag: v0.6.3-rc.2
   sonobuoy:
     repository: rancher/mirrored-sonobuoy-sonobuoy
     tag: v0.57.3

go.mod

@@ -1,6 +1,8 @@
 module github.com/rancher/cis-operator
 
-go 1.23.6
+go 1.24.4
+
+toolchain go1.24.6
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
@@ -9,23 +11,23 @@ require (
 	github.com/prometheus/client_golang v1.21.1
 	github.com/rancher/kubernetes-provider-detector v0.1.5
 	github.com/rancher/lasso v0.2.1
-	github.com/rancher/security-scan v0.6.2
+	github.com/rancher/security-scan v0.6.3-rc.2
 	github.com/rancher/wrangler/v3 v3.2.0
 	github.com/robfig/cron v1.2.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/urfave/cli/v2 v2.27.6
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20250406160420-959f8f3db0fb
-	k8s.io/api v0.32.3
+	k8s.io/api v0.33.4
 	k8s.io/apiextensions-apiserver v0.32.3
-	k8s.io/apimachinery v0.32.3
-	k8s.io/client-go v0.32.3
+	k8s.io/apimachinery v0.33.4
+	k8s.io/client-go v0.33.4
 )
 
 require (
-	github.com/aquasecurity/kube-bench v0.10.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/securityhub v1.57.0 // indirect
-	github.com/aws/smithy-go v1.22.2 // indirect
+	github.com/aquasecurity/kube-bench v0.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.39.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/securityhub v1.64.2 // indirect
+	github.com/aws/smithy-go v1.23.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
@@ -39,13 +41,11 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.2.4 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/glog v1.2.5 // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -71,17 +71,17 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
-	golang.org/x/mod v0.23.0 // indirect
-	golang.org/x/net v0.36.0 // indirect
+	golang.org/x/mod v0.26.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/term v0.29.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/term v0.33.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.30.0 // indirect
-	google.golang.org/protobuf v1.36.3 // indirect
+	golang.org/x/tools v0.35.0 // indirect
+	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -90,10 +90,11 @@ require (
 	k8s.io/gengo v0.0.0-20250130153323-76c5745d3511 // indirect
 	k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 // indirect
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
 	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
 	sigs.k8s.io/controller-runtime v0.20.3 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )