Add CI

2026-08-09 21:46:33 -04:00
parent a49903fbe8
commit 8955ba6873
4 changed files with 201 additions and 1 deletions
@@ -0,0 +1,77 @@
+name: Kube-bench CIS scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  kube-bench:
+    name: Scan ephemeral K3s cluster
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install k3d
+        run: curl -sfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
+
+      - name: Create ephemeral K3s cluster
+        run: |
+          k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
+          kubectl wait --for=condition=Ready nodes --all --timeout=180s
+          kubectl get nodes -o wide
+
+      - name: Run kube-bench
+        id: scan
+        shell: bash
+        run: |
+          set +e
+          mkdir -p artifacts
+          kubectl create namespace kube-bench --dry-run=client -o yaml | kubectl apply -f -
+          kubectl apply -f ci/kube-bench-k3s-job.yaml
+          kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s
+          job_rc=$?
+          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true
+
+          if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then
+            echo "kube-bench did not produce valid JSON" >&2
+            cat artifacts/kube-bench-k3s-cis-1.7.json
+            exit 1
+          fi
+
+          pass_count=$(jq '[.. | objects | select(has("total_pass")) | .total_pass] | add // 0' artifacts/kube-bench-k3s-cis-1.7.json)
+          warn_count=$(jq '[.. | objects | select(has("total_warn")) | .total_warn] | add // 0' artifacts/kube-bench-k3s-cis-1.7.json)
+          fail_count=$(jq '[.. | objects | select(has("total_fail")) | .total_fail] | add // 0' artifacts/kube-bench-k3s-cis-1.7.json)
+
+          {
+            echo "## kube-bench CIS K3s 1.7"
+            echo
+            echo "| Result | Count |"
+            echo "| --- | ---: |"
+            echo "| Pass | ${pass_count} |"
+            echo "| Warn | ${warn_count} |"
+            echo "| Fail | ${fail_count} |"
+            echo
+            echo "Findings are reported as an artifact. The disposable K3d baseline is not a merge gate yet."
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          exit "$job_rc"
+
+      - name: Upload kube-bench report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kube-bench-k3s-cis-1.7
+          path: artifacts/kube-bench-k3s-cis-1.7.json
+          if-no-files-found: warn
+
+      - name: Delete ephemeral cluster
+        if: always()
+        run: k3d cluster delete security-baseline
+