From 7cd6b32ebb5f6c9503daf6069fe8480e41020505 Mon Sep 17 00:00:00 2001 From: Liz Rice <liz@lizrice.com> Date: Tue, 7 Apr 2020 14:04:42 +0100 Subject: [PATCH] docs: notes in README for common misunderstandings (#602) Added a Please Note section to document common misunderstandings that often lead to incorrect issue filings --- README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 13813ae..01e6904 100644 --- a/README.md +++ b/README.md @@ -10,10 +10,17 @@ kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). -Note that it is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments. - Tests are configured with YAML files, making this tool easy to update as test specifications evolve. +### Please Note + +1. kube-bench implements the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the [CIS community](https://cisecurity.org). + +1. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See [CIS Kubernetes Benchmark support](#cis-kubernetes-benchmark-support) to see which releases of Kubernetes are covered by different releases of the benchmark. + +1. It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments. + +  Table of Contents -- GitLab