Add AKS-1.7 version #1874
Add AKS-1.7 version #1874
Conversation
|
|
|
We need to add a benchmark version mapping for the aks platform in the getPlatformBenchmarkVersion function. Without this mapping, AKS clusters (e.g., aks-1.7) will fall back to the default CIS profile. Consider adding a case for "aks" similar to how it's handled for eks, gke, etc. |
| @@ -490,6 +490,8 @@ func getPlatformBenchmarkVersion(platform Platform) string { | |||
| switch platform.Name { | |||
| case "eks": | |||
| return "eks-1.5.0" | |||
| case "aks": | |||
There was a problem hiding this comment.
Most managed clusters embed the platform name in the Kubernetes version (e.g., "v1.32.3-gke.1785003"), but AKS doesn't. So, our current logic fails to detect AKS platform—we’ll need an alternative method to identify them and apply AKS-specific CIS rules.
|
Added a new function isAKS to the utility file to identify AKS-specific clusters. Also, included test cases for it. |
| @@ -485,11 +494,33 @@ func getPlatformInfoFromVersion(s string) Platform { | |||
| } | |||
| } | |||
|
|
|||
| func IsAKS(ctx context.Context, k8sClient kubernetes.Interface) (bool, error) { | |||
| // Query the nodes for any annotations that indicate AKS (Azure Kubernetes Service) | |||
There was a problem hiding this comment.
The IsAKS function relies on the azure-identity-binding annotation, which isn't present in all AKS clusters. Instead, check reliable AKS indicators like labels or any other.
| @@ -300,6 +300,7 @@ func getKubeVersion() (*KubeVersion, error) { | |||
| glog.V(3).Infof("Error fetching cluster config: %s", err) | |||
| } | |||
| isRKE := false | |||
| isAKS := false // Variable to track AKS detection | |||
There was a problem hiding this comment.
do we really need this comment?
| } | ||
|
|
||
| if k8sVer, err := getKubeVersionFromRESTAPI(); err == nil { | ||
| glog.V(2).Info(fmt.Sprintf("Kubernetes REST API Reported version: %s", k8sVer)) | ||
| if isRKE { | ||
| k8sVer.GitVersion = k8sVer.GitVersion + "-rancher1" | ||
| } | ||
| if isAKS { | ||
| k8sVer.GitVersion = k8sVer.GitVersion + "-aks1" // Mark it as AKS in the version |
Adding AKS 1.7.0 benchmark
CIS Azure Kubernetes Service (AKS) Benchmark v1.7.0 PDF.pdf