https://github.com/luckylittle/ansible-role-openshift4-cis

CIS Kubernetes Benchmark 1.5.1 tailored to Red Hat OpenShift v4
https://github.com/luckylittle/ansible-role-openshift4-cis

ansible ansible-hardening-role ansible-role cis hardening kubernetes kubernetes-hardening openshift openshift-hardening openshift4 openshift4-cis

Last synced: 4 months ago
JSON representation

CIS Kubernetes Benchmark 1.5.1 tailored to Red Hat OpenShift v4

Host: GitHub
URL: https://github.com/luckylittle/ansible-role-openshift4-cis
Owner: luckylittle
License: mit
Created: 2020-03-19T21:28:43.000Z (over 6 years ago)
Default Branch: master
Last Pushed: 2022-10-12T06:54:11.000Z (almost 4 years ago)
Last Synced: 2025-04-05T17:51:11.745Z (over 1 year ago)
Topics: ansible, ansible-hardening-role, ansible-role, cis, hardening, kubernetes, kubernetes-hardening, openshift, openshift-hardening, openshift4, openshift4-cis
Size: 967 KB
Stars: 3
Watchers: 1
Forks: 2
Open Issues: 0
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE

README

WIP -- ansible-role-openshift4-cis
=========

Based on [CIS Kubernetes Benchmark v1.5.1](docs/CIS_Kubernetes_Benchmark_v1.5.1.pdf) [14 Feb 2020].

Requirements
------------

Tested on ansible `2.9.4`. It also requires `kubectl` for the category `5` tasks.

Role Variables
--------------

* `scored`
* `not_scored`
* `level_1`
* `level_2`
* `path_to_cni_files`
* `proxy_kubeconfig_file`
* `client_ca_file`
* `kubelet_config`

Dependencies
------------

Unknown at the moment

Example Playbook
----------------

Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:

* `requirements.yml`:

```yaml
- src: https://github.com/luckylittle/ansible-role-openshift4-cis
version: master
```

* `playbook.yaml`:

```yaml
- hosts: all
remote_user: core
roles:
- ansible-role-openshift4-cis
```

* Execution:

```bash
ansible-galaxy install --force -r requirements.yml -p roles/
ansible-playbook -i inventory
```

The `inventory` must contain specific host groups, that the role relies on:

```ini
[localhost]
localhost

[masters]
master[0:2]

[etcd:children]
masters

[workers]
worker[0:4]
```

License
-------

MIT

Author Information
------------------

Lucian Maly <>

Some inspiration from [this source](https://github.com/aquasecurity/kube-bench/tree/5f34058dc789e481ccc3b49248ebb02763bdce40/cfg/rh-0.7) was used.

---

_Last update: Mon Mar 30 04:25:20 UTC 2020_