Upgrade kubebench pack to 1.15.6

packs/cks-kubebench-1.15.6/README.md

@@ -0,0 +1,106 @@
+# Kube-bench
+
+Kube-bench is an open-source tool developed by Aqua Security that checks whether Kubernetes is deployed according to the CIS Kubernetes Benchmark recommendations.
+The tool performs automated security checks against Kubernetes components and node configuration, generating findings categorized as PASS, FAIL, WARN, and INFO.
+This addon deploys kube-bench as a Kubernetes Job and performs a one-time security assessment of the cluster.
+
+## Prerequisites
+
+* Kubernetes 1.29 or later.
+* Permissions to create and execute Kubernetes Jobs.
+* Worker nodes must allow the hostPath mounts required by kube-bench.
+
+> **Note:**
+> Managed Kubernetes services such as Amazon EKS, Azure AKS, and Google GKE may restrict access to certain control plane components. As a result, some benchmark checks may be skipped or reported differently compared to self-managed Kubernetes environments.
+
+Kube-bench requires access to host filesystem paths in order to inspect Kubernetes node configuration and evaluate CIS benchmark compliance.
+
+## Parameters
+
+| Name             | Description                                   | Type   | Default Value      | Required |
+| ---------------- | --------------------------------------------- | ------ | ------------------ | -------- |
+| image.repository | Container image repository used by kube-bench | string | aquasec/kube-bench | Yes      |
+| image.tag        | kube-bench image version                      | string | v0.15.6            | Yes      |
+
+## Upgrade
+
+Upgrade from previous versions of this addon is supported.
+
+## Usage
+
+After installation, verify that the Job has been created successfully:
+
+```sh
+kubectl get jobs -A
+```
+
+Verify that the Pod associated with the Job has been created:
+
+```sh
+kubectl get pods -A | grep kube-bench
+```
+
+Once the Job has completed, retrieve the benchmark results:
+
+```sh
+kubectl logs job/kube-bench
+```
+
+The output contains CIS benchmark findings similar to:
+
+```text
+PASS
+FAIL
+WARN
+INFO
+```
+
+## Validation
+
+### Verify Job Completion
+
+```sh
+kubectl get jobs -A
+```
+
+Expected result:
+
+```text
+NAME         COMPLETIONS   DURATION   AGE
+kube-bench   1/1           <time>     <age>
+```
+
+### Verify Pod Status
+
+```sh
+kubectl get pods -A | grep kube-bench
+```
+
+Expected result:
+
+```text
+STATUS
+Completed
+```
+
+### Verify Benchmark Results
+
+```sh
+kubectl logs job/kube-bench
+```
+
+Expected output contains one or more of the following result types:
+
+```text
+PASS
+FAIL
+WARN
+INFO
+```
+
+These results indicate that kube-bench successfully executed the CIS benchmark checks against the cluster.
+
+## References
+
+* https://github.com/aquasecurity/kube-bench
+* https://aquasecurity.github.io/kube-bench/

packs/cks-kubebench-1.15.6/manifests/job.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kube-bench
+spec:
+  template:
+    metadata:
+      labels:
+        app: kube-bench
+    spec:
+      containers:
+        - command: ["kube-bench"]
+          image: docker.io/aquasec/kube-bench:v0.15.6
+          name: kube-bench
+          volumeMounts:
+            - name: var-lib-cni
+              mountPath: /var/lib/cni
+              readOnly: true
+            - mountPath: /var/lib/etcd
+              name: var-lib-etcd
+              readOnly: true
+            - mountPath: /var/lib/kubelet
+              name: var-lib-kubelet
+              readOnly: true
+            - mountPath: /var/lib/kube-scheduler
+              name: var-lib-kube-scheduler
+              readOnly: true
+            - mountPath: /var/lib/kube-controller-manager
+              name: var-lib-kube-controller-manager
+              readOnly: true
+            - mountPath: /etc/systemd
+              name: etc-systemd
+              readOnly: true
+            - mountPath: /lib/systemd/
+              name: lib-systemd
+              readOnly: true
+            - mountPath: /srv/kubernetes/
+              name: srv-kubernetes
+              readOnly: true
+            - mountPath: /etc/kubernetes
+              name: etc-kubernetes
+              readOnly: true
+            - mountPath: /usr/local/mount-from-host/bin
+              name: usr-bin
+              readOnly: true
+            - mountPath: /etc/cni/net.d/
+              name: etc-cni-netd
+              readOnly: true
+            - mountPath: /opt/cni/bin/
+              name: opt-cni-bin
+              readOnly: true
+      hostPID: true
+      restartPolicy: Never
+      volumes:
+        - name: var-lib-cni
+          hostPath:
+            path: /var/lib/cni
+        - hostPath:
+            path: /var/lib/etcd
+          name: var-lib-etcd
+        - hostPath:
+            path: /var/lib/kubelet
+          name: var-lib-kubelet
+        - hostPath:
+            path: /var/lib/kube-scheduler
+          name: var-lib-kube-scheduler
+        - hostPath:
+            path: /var/lib/kube-controller-manager
+          name: var-lib-kube-controller-manager
+        - hostPath:
+            path: /etc/systemd
+          name: etc-systemd
+        - hostPath:
+            path: /lib/systemd
+          name: lib-systemd
+        - hostPath:
+            path: /srv/kubernetes
+          name: srv-kubernetes
+        - hostPath:
+            path: /etc/kubernetes
+          name: etc-kubernetes
+        - hostPath:
+            path: /usr/bin
+          name: usr-bin
+        - hostPath:
+            path: /etc/cni/net.d/
+          name: etc-cni-netd
+        - hostPath:
+            path: /opt/cni/bin/
+          name: opt-cni-bin

packs/cks-kubebench-1.15.6/pack.json

@@ -0,0 +1,17 @@
+{
+    "addonType": "security",
+    "annotations": {
+      "source": "community",
+      "contributor" : "spectrocloud"
+    },    
+    "kubeManifests": [
+      "manifests/job.yaml"
+    ],
+    "cloudTypes": [
+      "all"
+    ],
+    "displayName": "Kubebench",
+    "layer":"addon",
+    "name": "kubebench",
+    "version": "1.15.6"
+  }