Migrating from Rancher CIS Benchmark to Rancher Compliance

• Rancher v2.12.x+

Rancher Manager v2.12.0 introduces a new Compliance App, which replaces the former CIS Benchmark App while providing the same feature set. The cluster view will now refer to this feature as Compliance.

An upgraded cluster, which had CIS Benchmark installed, will notice that the UI will no longer show the CIS Benchmark section. The new Compliance App will need to be installed for the new section to show up.

After installing the new App, it is possible to copy over any custom benchmarks and profiles by renaming the previous group name cis.cattle.io to the new compliance.cattle.io.

Copying custom created Profiles and Benchmark (Versions) can be automated with:

kubectl get clusterscanbenchmarks.cis.cattle.io -o json | \
jq -r '.items[] | select(.metadata.annotations["meta.helm.sh/release-name"] != "rancher-cis-benchmark" or .metadata.annotations["meta.helm.sh/release-name"] == null) | .' | sed 's/cis.cattle.io/compliance.cattle.io/g' | kubectl apply -f -

kubectl get clusterscanprofiles.cis.cattle.io -o json | \
jq -r '.items[] | select(.metadata.annotations["clusterscanprofile.cis.cattle.io/builtin"] != "true" or .metadata.annotations["clusterscanprofile.cis.cattle.io/builtin"] == null) | .' | sed 's/cis.cattle.io/compliance.cattle.io/g' | kubectl apply -f -

Note that for the above script to work, both applications must be installed in the cluster.

At this point the previous CIS Benchmark App can be safely uninstalled.