Skip to content

Commit 1988893

Browse files
jimmidysonjimmidyson
committed
ci: Add CIS benchmark check
1 parent f9c2f95 commit 1988893

File tree

5 files changed

+125
-2
lines changed

5 files changed

+125
-2
lines changed

‎.github/workflows/checks.yml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,6 @@ jobs:
6767
- {"provider": "Nutanix", "kubernetesMinor": "v1.30", "kubernetesVersion": "v1.30.10", "baseOS": "rocky-9.5"}
6868
- {"provider": "Nutanix", "kubernetesMinor": "v1.31", "kubernetesVersion": "v1.31.4", "baseOS": "rocky-9.5"}
6969
- {"provider": "Nutanix", "kubernetesMinor": "v1.32", "kubernetesVersion": "v1.32.3", "baseOS": "rocky-9.5"}
70-
- {"provider": "Docker", "kubernetesMinor": "v1.30", "kubernetesVersion": "v1.30.12"}
7170
- {"provider": "Docker", "kubernetesMinor": "v1.31", "kubernetesVersion": "v1.31.8"}
7271
- {"provider": "Docker", "kubernetesMinor": "v1.32", "kubernetesVersion": "v1.32.4"}
7372
- {"provider": "Docker", "kubernetesMinor": "v1.33", "kubernetesVersion": "v1.33.0"}
@@ -116,6 +115,37 @@ jobs:
116115
contents: read
117116
checks: write
118117

118+
cis-benchmark:
119+
needs:
120+
- "lint-gha"
121+
- "lint-go"
122+
- "lint-test-helm"
123+
- "pre-commit"
124+
- "unit-test"
125+
strategy:
126+
matrix:
127+
config:
128+
- {"provider": "Nutanix", "kubernetesMinor": "v1.32", "kubernetesVersion": "v1.32.3", "baseOS": "rocky-9.5"}
129+
- {"provider": "Docker", "kubernetesMinor": "v1.33", "kubernetesVersion": "v1.33.0"}
130+
# Uncomment below once we have the ability to run e2e tests on other providers from GHA.
131+
# - {"provider": "AWS", "kubernetesMinor": "v1.29", "kubernetesVersion": "v1.29.6"}
132+
fail-fast: false
133+
name: CIS Benchmark (${{ matrix.config.provider }} provider, Kubernetes ${{ matrix.config.kubernetesMinor }})
134+
uses: ./.github/workflows/e2e.yml
135+
with:
136+
focus: Quick start
137+
provider: ${{ matrix.config.provider }}
138+
kubernetes-version: ${{ matrix.config.kubernetesVersion }}
139+
runs-on: ${{ matrix.config.provider == 'Nutanix' && 'self-hosted-ncn-dind' || 'ubuntu-22.04' }}
140+
base-os: ${{ matrix.config.provider == 'Nutanix' && matrix.config.baseOS || '' }}
141+
run-cis-benchmark: true
142+
extra-labels: "cni:Cilium && addonStrategy:HelmAddon"
143+
secrets: inherit
144+
permissions:
145+
contents: read
146+
checks: write
147+
148+
119149
lint-go:
120150
runs-on: ubuntu-22.04
121151
strategy:

‎.github/workflows/e2e.yml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ on:
1414
focus:
1515
description: e2e tests to focus
1616
type: string
17+
extra-labels:
18+
description: Extra labels to pass to the e2e tests
19+
type: string
1720
runs-on:
1821
description: The runner to run the e2e tests on
1922
type: string
@@ -26,6 +29,10 @@ on:
2629
description: The OS image to use for the machine template
2730
type: string
2831
required: false
32+
run-cis-benchmark:
33+
description: Whether to run the CIS benchmark tests
34+
type: boolean
35+
default: false
2936

3037
jobs:
3138
e2e-test:
@@ -78,7 +85,7 @@ jobs:
7885
df -h
7986
8087
- name: Run e2e tests
81-
run: devbox run -- make e2e-test E2E_LABEL='provider:${{ inputs.provider }}' E2E_SKIP='${{ inputs.skip }}' E2E_FOCUS='${{ inputs.focus }}' E2E_VERBOSE=true
88+
run: devbox run -- make e2e-test E2E_LABEL='provider:${{ inputs.provider }}${{format(' {0} {1}', inputs.extra-labels != '' && '&&' || '', inputs.extra-labels)}}' E2E_SKIP='${{ inputs.skip }}' E2E_FOCUS='${{ inputs.focus }}' E2E_VERBOSE=true
8289
env:
8390
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8491
DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -95,6 +102,13 @@ jobs:
95102
KUBERNETES_VERSION_NUTANIX: ${{ inputs.kubernetes-version }}
96103
KINDEST_IMAGE_TAG: ${{ inputs.kubernetes-version }}
97104
E2E_KUBERNETES_VERSION: ${{ inputs.kubernetes-version }}
105+
RUN_CIS_BENCHMARK: ${{ inputs.run-cis-benchmark }}
106+
107+
- name: Add job summary for CIS benchmark
108+
if: inputs.run-cis-benchmark
109+
run: |
110+
echo "## CIS Benchmark" >>"${GITHUB_STEP_SUMMARY}"
111+
cat test/e2e/cis-benchmark-report.txt >>"${GITHUB_STEP_SUMMARY}"
98112
99113
- if: success() || failure() # always run even if the previous step fails
100114
name: Publish e2e test report

‎devbox.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"rsync@latest",
3232
"setup-envtest@latest",
3333
"shfmt@latest",
34+
"trivy@latest",
3435
"yamale@latest",
3536
"yamllint@latest",
3637
"yq-go@latest",

‎devbox.lock‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1720,6 +1720,54 @@
17201720
}
17211721
}
17221722
},
1723+
"trivy@latest": {
1724+
"last_modified": "2025-04-28T01:45:31Z",
1725+
"resolved": "github:NixOS/nixpkgs/29335f23bea5e34228349ea739f31ee79e267b88#trivy",
1726+
"source": "devbox-search",
1727+
"version": "0.61.1",
1728+
"systems": {
1729+
"aarch64-darwin": {
1730+
"outputs": [
1731+
{
1732+
"name": "out",
1733+
"path": "/nix/store/4s34i0ml8hxficr4v7csyigg4dy2pxhp-trivy-0.61.1",
1734+
"default": true
1735+
}
1736+
],
1737+
"store_path": "/nix/store/4s34i0ml8hxficr4v7csyigg4dy2pxhp-trivy-0.61.1"
1738+
},
1739+
"aarch64-linux": {
1740+
"outputs": [
1741+
{
1742+
"name": "out",
1743+
"path": "/nix/store/7ggs35rbylfxapxswngs0pvpisqj3cjz-trivy-0.61.1",
1744+
"default": true
1745+
}
1746+
],
1747+
"store_path": "/nix/store/7ggs35rbylfxapxswngs0pvpisqj3cjz-trivy-0.61.1"
1748+
},
1749+
"x86_64-darwin": {
1750+
"outputs": [
1751+
{
1752+
"name": "out",
1753+
"path": "/nix/store/fs9lzjqj925m9kqvlgvvrs4q4lq6f0ps-trivy-0.61.1",
1754+
"default": true
1755+
}
1756+
],
1757+
"store_path": "/nix/store/fs9lzjqj925m9kqvlgvvrs4q4lq6f0ps-trivy-0.61.1"
1758+
},
1759+
"x86_64-linux": {
1760+
"outputs": [
1761+
{
1762+
"name": "out",
1763+
"path": "/nix/store/vcqkzvwxzxij69i2jaxmfkx4zl0ywlv6-trivy-0.61.1",
1764+
"default": true
1765+
}
1766+
],
1767+
"store_path": "/nix/store/vcqkzvwxzxij69i2jaxmfkx4zl0ywlv6-trivy-0.61.1"
1768+
}
1769+
}
1770+
},
17231771
"yamale@latest": {
17241772
"last_modified": "2025-03-11T17:52:14Z",
17251773
"resolved": "github:NixOS/nixpkgs/0d534853a55b5d02a4ababa1d71921ce8f0aee4c#yamale",

‎test/e2e/quick_start_test.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ package e2e
88
import (
99
"fmt"
1010
"os"
11+
"os/exec"
12+
"path/filepath"
1113
"slices"
1214
"strconv"
1315
"strings"
@@ -307,6 +309,34 @@ var _ = Describe("Quick start", func() {
307309
),
308310
},
309311
)
312+
313+
if os.Getenv("RUN_CIS_BENCHMARK") == "true" {
314+
By("Running CIS benchmark against workload cluster")
315+
316+
trivyCmd := exec.Command( //nolint:gosec // Only used for testing so safe here.
317+
"trivy",
318+
"k8s",
319+
"--compliance=k8s-cis-1.23",
320+
"--disable-node-collector",
321+
"--report=summary",
322+
fmt.Sprintf(
323+
"--output=%s",
324+
filepath.Join(
325+
os.Getenv("GIT_REPO_ROOT"),
326+
"cis-benchmark-report.txt",
327+
),
328+
),
329+
fmt.Sprintf(
330+
"--kubeconfig=%s",
331+
workloadProxy.GetKubeconfigPath(),
332+
),
333+
)
334+
335+
trivyCmd.Stdout = GinkgoWriter
336+
trivyCmd.Stderr = GinkgoWriter
337+
338+
Expect(trivyCmd.Run()).To(Succeed(), "CIS benchmark failed")
339+
}
310340
},
311341
}
312342
})

0 commit comments

Comments
 (0)