cis-operator

cis-operator

Chainguard's redistribution of the rancher-cis-benchmark Helm chart, pre-configured with hardened Chainguard Images.

The chart bundles the Rancher CIS Benchmark operator together with the scan components (rancher-security-scan, sonobuoy, kubectl) used to run CIS Kubernetes benchmark scans against a cluster.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret in the target namespace:

kubectl create namespace cis-operator-system
kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace cis-operator-system

Installation

helm install rancher-cis-benchmark oci://cgr.dev/ORGANIZATION/charts/cis-operator \
  --namespace cis-operator-system \
  --create-namespace \
  --set global.imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream rancher-cis-benchmark Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://github.com/rancher/cis-operator