Help with running on RKE2

[whgibbo]

Hi,
I'm trying to run this on RKE2, using the following:

# kubectl apply -f ./kube-bench.yaml -n kube-system
# kubectl get pods -n kube-system | grep kube-bench
# kubectl logs -n kube-system kube-bench-rke2-66rq8 > ./kube-bench.txt

---
apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench-rke2
spec:
  template:
    metadata:
      labels:
        app: kube-bench
    spec:
      hostPID: true
      containers:
        - name: kube-bench
          image: docker.io/aquasec/kube-bench:v0.11.2-ub@sha256:a2b533d9e72408d0bcbe6747c7a7c4dbce3781dbda538a0e267c4638d646b12e
          command: ["kube-bench"]
          args:
            - "--benchmark"
            - "rke2-cis-1.24"
          volumeMounts:
            # Mount the RKE2 specific paths
            - name: var-lib-rancher-rke2
              mountPath: /var/lib/rancher/rke2
              readOnly: true
            - name: etc-rancher-rke2
              mountPath: /etc/rancher/rke2
              readOnly: true
            - name: etc
              mountPath: /etc
              readOnly: true
      restartPolicy: Never
      volumes:
        # RKE2 specific host paths
        - name: var-lib-rancher-rke2
          hostPath:
            path: /var/lib/rancher/rke2
            type: DirectoryOrCreate
        - name: etc-rancher-rke2
          hostPath:
            path: /etc/rancher/rke2
            type: DirectoryOrCreate
        - name: etc
          hostPath:
            path: /etc
            type: Directory

But I see a few failures.

• [FAIL] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
  • But when I check the permissions they are correct..
• [WARN] 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)
  • Seems the check_cafile_permissions.sh is missing, does this need to be created manually
• [WARN] 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual)
  • Seems the check_cafile_ownership.sh is missing, does this need to be created manually

Checking
https://documentation.suse.com/cloudnative/rancher-manager/latest/en/security/hardening-guides/rke2/self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.html I see there are some different steps/scripts.. Was wondering if there was any plans to update, happy to help and test.. Just need some pointers.

Thanks