diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6eb0c17a79..65731766f0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -95,7 +95,7 @@ jobs: with: fetch-depth: 0 - name: Dry-run release snapshot - uses: goreleaser/goreleaser-action@v4 + uses: goreleaser/goreleaser-action@v5 with: distribution: goreleaser version: v1.7.0 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 625b5bf169..5e943a2755 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -17,7 +17,7 @@ jobs: - name: Check Out Repo uses: actions/checkout@v3 - name: Set up QEMU - uses: docker/setup-qemu-action@v2 + uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx id: buildx uses: docker/setup-buildx-action@v2 @@ -41,7 +41,7 @@ jobs: password: ${{ secrets.ECR_SECRET_ACCESS_KEY }} - name: Get version id: get_version - uses: crazy-max/ghaction-docker-meta@v4 + uses: crazy-max/ghaction-docker-meta@v5 with: images: ${{ env.REP }} tag-semver: | @@ -49,7 +49,7 @@ jobs: - name: Build and push - Docker/ECR id: docker_build - uses: docker/build-push-action@v4 + uses: docker/build-push-action@v5 with: context: . platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x @@ -67,7 +67,7 @@ jobs: - name: Build and push ubi image - Docker/ECR id: docker_build_ubi - uses: docker/build-push-action@v4 + uses: docker/build-push-action@v5 with: context: . platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x @@ -86,7 +86,7 @@ jobs: - name: Build and push fips ubi image - Docker/ECR id: docker_build_fips_ubi - uses: docker/build-push-action@v4 + uses: docker/build-push-action@v5 with: context: . platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7f5d6edcce..a6633d9130 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,7 +44,7 @@ jobs: second_file_path: integration/testdata/Expected_output.data expected_result: PASSED - name: Release - uses: goreleaser/goreleaser-action@v4 + uses: goreleaser/goreleaser-action@v5 with: distribution: goreleaser version: v1.7.0 diff --git a/Dockerfile b/Dockerfile index 97d57053bf..d0814af493 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.6 AS build +FROM golang:1.21.1 AS build WORKDIR /go/src/github.com/aquasecurity/kube-bench/ COPY makefile makefile COPY go.mod go.sum ./ @@ -9,7 +9,7 @@ COPY internal/ internal/ ARG KUBEBENCH_VERSION RUN make build && cp kube-bench /go/bin/kube-bench -FROM alpine:3.18.2 AS run +FROM alpine:3.18.3 AS run WORKDIR /opt/kube-bench/ # add GNU ps for -C, -o cmd, and --no-headers support # https://github.com/aquasecurity/kube-bench/issues/109 diff --git a/Dockerfile.fips.ubi b/Dockerfile.fips.ubi index 1860beb628..40b1a3e89c 100644 --- a/Dockerfile.fips.ubi +++ b/Dockerfile.fips.ubi @@ -1,4 +1,4 @@ -FROM golang:1.20.6 AS build +FROM golang:1.21.1 AS build WORKDIR /go/src/github.com/aquasecurity/kube-bench/ COPY makefile makefile COPY go.mod go.sum ./ diff --git a/Dockerfile.ubi b/Dockerfile.ubi index fb90061eb5..c7782a3cea 100644 --- a/Dockerfile.ubi +++ b/Dockerfile.ubi @@ -1,4 +1,4 @@ -FROM golang:1.20.6 AS build +FROM golang:1.21.1 AS build WORKDIR /go/src/github.com/aquasecurity/kube-bench/ COPY makefile makefile COPY go.mod go.sum ./ diff --git a/README.md b/README.md index 88b7b59fc9..52c8f8f561 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,12 @@ Tests are configured with YAML files, making this tool easy to update as test sp ![Kubernetes Bench for Security](/docs/images/output.png "Kubernetes Bench for Security") -### Quick start +## CIS Scanning as part of Trivy and the Trivy Operator + +[Trivy](https://github.com/aquasecurity/trivy), the all in one cloud native security scanner, can be deployed as a [Kubernetes Operator](https://github.com/aquasecurity/trivy-operator) inside a cluster. +Both, the [Trivy CLI](https://github.com/aquasecurity/trivy), and the [Trivy Operator](https://github.com/aquasecurity/trivy-operator) support CIS Kubernetes Benchmark scanning among several other features. + +## Quick start There are multiple ways to run kube-bench. You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored. diff --git a/go.mod b/go.mod index 05f4731f05..45ff9b1996 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/aws/aws-sdk-go-v2/config v1.18.4 github.com/aws/aws-sdk-go-v2/service/securityhub v1.29.1 github.com/fatih/color v1.14.1 - github.com/golang/glog v1.0.0 + github.com/golang/glog v1.1.2 github.com/magiconair/properties v1.8.7 github.com/onsi/ginkgo v1.16.5 github.com/pkg/errors v0.9.1 diff --git a/go.sum b/go.sum index e39f8a0cf0..3e21304801 100644 --- a/go.sum +++ b/go.sum @@ -137,8 +137,8 @@ github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= -github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ= -github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4= +github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo= +github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ= github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= diff --git a/job.yaml b/job.yaml index 9db1781086..adf81cefc9 100644 --- a/job.yaml +++ b/job.yaml @@ -11,7 +11,7 @@ spec: spec: containers: - command: ["kube-bench"] - image: docker.io/aquasec/kube-bench:v0.6.17 + image: docker.io/aquasec/kube-bench:v0.6.19 name: kube-bench volumeMounts: - mountPath: /var/lib/etcd