Update kubebench pack to 0.16.0

packs/cks-kubebench-0.16.0/README.md

@@ -0,0 +1,106 @@
+# Kube-bench
+
+Kube-bench is an open-source tool developed by Aqua Security that checks whether Kubernetes is deployed according to the CIS Kubernetes Benchmark recommendations.
+The tool performs automated security checks against Kubernetes components and node configuration, generating findings categorized as PASS, FAIL, WARN, and INFO.
+This addon deploys kube-bench as a Kubernetes Job and performs a one-time security assessment of the cluster.
+
+## Prerequisites
+
+* Kubernetes 1.29 or later.
+* Permissions to create and execute Kubernetes Jobs.
+* Worker nodes must allow the hostPath mounts required by kube-bench.
+
+> **Note:**
+> Managed Kubernetes services such as Amazon EKS, Azure AKS, and Google GKE may restrict access to certain control plane components. As a result, some benchmark checks may be skipped or reported differently compared to self-managed Kubernetes environments.
+
+Kube-bench requires access to host filesystem paths in order to inspect Kubernetes node configuration and evaluate CIS benchmark compliance.
+
+## Parameters
+
+| Name             | Description                                   | Type   | Default Value      | Required |
+| ---------------- | --------------------------------------------- | ------ | ------------------ | -------- |
+| image.repository | Container image repository used by kube-bench | string | aquasec/kube-bench | Yes      |
+| image.tag        | kube-bench image version                      | string | v0.16.0            | Yes      |
+
+## Upgrade
+
+Upgrade from previous versions of this addon is supported.
+
+## Usage
+
+After installation, verify that the Job has been created successfully:
+
+```sh
+kubectl get jobs -A
+```
+
+Verify that the Pod associated with the Job has been created:
+
+```sh
+kubectl get pods -A | grep kube-bench
+```
+
+Once the Job has completed, retrieve the benchmark results:
+
+```sh
+kubectl logs job/kube-bench
+```
+
+The output contains CIS benchmark findings similar to:
+
+```text
+PASS
+FAIL
+WARN
+INFO
+```
+
+## Validation
+
+### Verify Job Completion
+
+```sh
+kubectl get jobs -A
+```
+
+Expected result:
+
+```text
+NAME         COMPLETIONS   DURATION   AGE
+kube-bench   1/1           <time>     <age>
+```
+
+### Verify Pod Status
+
+```sh
+kubectl get pods -A | grep kube-bench
+```
+
+Expected result:
+
+```text
+STATUS
+Completed
+```
+
+### Verify Benchmark Results
+
+```sh
+kubectl logs job/kube-bench
+```
+
+Expected output contains one or more of the following result types:
+
+```text
+PASS
+FAIL
+WARN
+INFO
+```
+
+These results indicate that kube-bench successfully executed the CIS benchmark checks against the cluster.
+
+## References
+
+* https://github.com/aquasecurity/kube-bench
+* https://aquasecurity.github.io/kube-bench/

packs/cks-kubebench-0.16.0/manifests/job.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kube-bench
+spec:
+  template:
+    metadata:
+      labels:
+        app: kube-bench
+    spec:
+      containers:
+      - command: [ "kube-bench" ]
+        image: docker.io/aquasec/kube-bench:v0.16.0
+        name: kube-bench
+        volumeMounts:
+        - name: var-lib-cni
+          mountPath: /var/lib/cni
+          readOnly: true
+        - mountPath: /var/lib/etcd
+          name: var-lib-etcd
+          readOnly: true
+        - mountPath: /var/lib/kubelet
+          name: var-lib-kubelet
+          readOnly: true
+        - mountPath: /var/lib/kube-scheduler
+          name: var-lib-kube-scheduler
+          readOnly: true
+        - mountPath: /var/lib/kube-controller-manager
+          name: var-lib-kube-controller-manager
+          readOnly: true
+        - mountPath: /etc/systemd
+          name: etc-systemd
+          readOnly: true
+        - mountPath: /lib/systemd/
+          name: lib-systemd
+          readOnly: true
+        - mountPath: /srv/kubernetes/
+          name: srv-kubernetes
+          readOnly: true
+        - mountPath: /etc/kubernetes
+          name: etc-kubernetes
+          readOnly: true
+        - mountPath: /usr/local/mount-from-host/bin
+          name: usr-bin
+          readOnly: true
+        - mountPath: /etc/cni/net.d/
+          name: etc-cni-netd
+          readOnly: true
+        - mountPath: /opt/cni/bin/
+          name: opt-cni-bin
+          readOnly: true
+      hostPID: true
+      restartPolicy: Never
+      volumes:
+      - name: var-lib-cni
+        hostPath:
+          path: /var/lib/cni
+      - hostPath:
+          path: /var/lib/etcd
+        name: var-lib-etcd
+      - hostPath:
+          path: /var/lib/kubelet
+        name: var-lib-kubelet
+      - hostPath:
+          path: /var/lib/kube-scheduler
+        name: var-lib-kube-scheduler
+      - hostPath:
+          path: /var/lib/kube-controller-manager
+        name: var-lib-kube-controller-manager
+      - hostPath:
+          path: /etc/systemd
+        name: etc-systemd
+      - hostPath:
+          path: /lib/systemd
+        name: lib-systemd
+      - hostPath:
+          path: /srv/kubernetes
+        name: srv-kubernetes
+      - hostPath:
+          path: /etc/kubernetes
+        name: etc-kubernetes
+      - hostPath:
+          path: /usr/bin
+        name: usr-bin
+      - hostPath:
+          path: /etc/cni/net.d/
+        name: etc-cni-netd
+      - hostPath:
+          path: /opt/cni/bin/
+        name: opt-cni-bin

packs/cks-kubebench-0.16.0/pack.json

@@ -0,0 +1,17 @@
+{
+    "addonType": "security",
+    "annotations": {
+      "source": "community",
+      "contributor" : "spectrocloud"
+    },    
+    "kubeManifests": [
+      "manifests/job.yaml"
+    ],
+    "cloudTypes": [
+      "all"
+    ],
+    "displayName": "Kubebench",
+    "layer":"addon",
+    "name": "kubebench",
+    "version": "0.16.0"
+  }

packs/cks-kubebench-0.16.0/values.yaml

@@ -0,0 +1,5 @@
+pack:
+  namespace: "kube-bench"
+  content:
+    images:
+      - image: docker.io/aquasec/kube-bench:v0.16.0