cis-benchmark action missing with 1.29/beta

[Yoshi Kadokawa]

The cis-benchmark action is missing from kubernetes-control-plane and kubernetes-worker from 1.29/beta.
This is necessary to validate CIS on Kubernetes cluster.

[Yoshi Kadokawa (yoshikadokawa)]

As this was available with 1.28/stable charm, and no other workaround is available,
subscribing this to field-critical.

[Yoshi Kadokawa (yoshikadokawa)]

for now as a workaround I have applied the kube-bench manually with the following commands inside each hosts, kubernetes-worker and kubernetes-control-plane.

Following steps were necessary to prep to run kube-bench:
wget https://github.com/charmed-kubernetes/kube-bench-config/archive/cis-1.23.zip
wget https://github.com/aquasecurity/kube-bench/releases/download/v0.6.19/kube-bench_0.6.19_linux_amd64.deb
sudo dpkg -i ./kube-bench_0.6.19_linux_amd64.deb
mkdir -p /home/ubuntu/kube-bench
unzip -d /home/ubuntu/kube-bench cis-1.23.zip

kubernetes-control-plane:
sudo kube-bench -D /home/ubuntu/kube-bench/kube-bench-config-cis-1.23 \
  --benchmark cis-1.23 \
  run --targets master

kubernetes-worker:
sudo kube-bench -D /home/ubuntu/kube-bench/kube-bench-config-cis-1.23 \
  --benchmark cis-1.23 \
  run --targets node

[Kevin W Monroe (kwmonroe)]

Dropping down to High given the workaround in #2. While not ideal nor convenient, that workaround is effectively what the action does. Targeting re-inclusion of the cis-benchmark action in 1.29+ck1.

[Kevin W Monroe (kwmonroe)]

CIS Kubernetes Benchmark scanning was made available in the Trivy CLI (in addition to quite a few more trivy features) last year:

https://www.aquasec.com/blog/trivy-kubernetes-cis-benchmark-scanning/

I've confirmed the manual steps from comment #2 are still valid for charmed k8s 1.29, as are the upstream trivy getting started instructions. Given that, the better solution here is to include something like a `trivy` action as a superset of the functionality that the `cis-benchmark` action provided.

I'm re-targeting this for the upcoming 1.30 release.

[Patrizio Bassi (patriziobassibdi)]

Hi, is 1.30 release fixing it?

Will it work in a airgapped environment where you cannot do wget from github, i mean can we attach resources? i don't see them in the actual charm implementation

[Adam Dyess (addyess)]

I took a stab at porting this.
https://github.com/charmed-kubernetes/charm-kubernetes-control-plane/pull/349

You can download the config and release into your airgapped installation, host them internally in your airgapped environment on a web service, then point the action to run from the corrected URLs.

juju run action <unit> cis-benchmark apply=<action> \
 config=https://airgapped.internal/kube-bench/config/archive/cis-1.23.zip#sha1=3cda2fc68b4ca36f69f5913bfc0b02576e7a3b3d \
 release=https://airgapped.internal/kube-bench/releases/download/v0.6.8/kube-bench_0.6.8_linux_amd64.tar.gz#sha256=5f9c5231949bd022a6993f5297cc05bb80a1b7c36a43cefed0a8c8af26778863

[Adam Dyess (addyess)]

While we have a possible fix for this, time doesn't permit the testing, and distribution of this change to the worker and control-plane charms. Slating for the 1.31 branch