cis-v1.23-t1.0.1 controls - move scope from cloud to cluster

[rcohencyberarmor]

PR Type:

Refactoring

---

PR Description:

This PR addresses the issue of changing the scanning scope from 'cloud' to 'cluster' in various CIS controls. This change is reflected in multiple JSON files under the 'controls' directory. The change is aimed at enhancing the accuracy and relevance of the scanning process.

---

PR Main Files Walkthrough:

files:

controls/C-0188-minimizeaccesstocreatepods.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0186-minimizeaccesstosecrets.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0146-ensurethatthecontrollermanageruseserviceaccountcredentialsargumentissettotrue.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0123-ensurethattheadmissioncontrolpluginalwayspullimagesisset.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0209-createadministrativeboundariesbetweenresourcesusingnamespaces.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0158-ensurethatthepeerautotlsargumentisnotsettotrue.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0157-ensurethatthepeerclientcertauthargumentissettotrue.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0191-limituseofthebindimpersonateandescalatepermissionsinthekubernetescluster.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0156-ensurethatthepeercertfileandpeerkeyfileargumentsaresetasappropriate.json: Changed the scanning scope from 'cloud' to 'cluster'.
controls/C-0175-verifythatthereadonlyportargumentissetto0.json: Changed the scanning scope from 'cloud' to 'cluster'.

---

User Description:

kubescape/kubescape#1420

[codiumai-pr-agent-free]

PR Analysis

• 🎯 Main theme: Changing scanning scope from 'cloud' to 'cluster' in various CIS controls
• 📝 PR summary: This PR involves refactoring of the scanning scope in various CIS controls from 'cloud' to 'cluster'. This change is aimed at enhancing the accuracy and relevance of the scanning process.
• 📌 Type of PR: Refactoring
• 🧪 Relevant tests added: No
• ⏱️ Estimated effort to review [1-5]: 2, because the changes are straightforward and repetitive, involving only a change in a single value across multiple files.
• 🔒 Security concerns: No security concerns found

PR Feedback

• 💡 General suggestions: The changes made in this PR are clear and straightforward. However, it would be beneficial to include a brief explanation of why the scanning scope was changed from 'cloud' to 'cluster' in the PR description. This would provide more context to reviewers and anyone looking at this change in the future.

• 🤖 Code feedback:

How to use

To invoke the PR-Agent, add a comment using one of the following commands:
/review [-i]: Request a review of your Pull Request. For an incremental review, which only considers changes since the last review, include the '-i' option.
/describe: Modify the PR title and description based on the contents of the PR.
/improve [--extended]: Suggest improvements to the code in the PR. Extended mode employs several calls, and provides a more thorough feedback.
/ask <QUESTION>: Pose a question about the PR.
/update_changelog: Update the changelog based on the PR's contents.

To edit any configuration parameter from configuration.toml, add --config_path=new_value
For example: /review --pr_reviewer.extra_instructions="focus on the file: ..."
To list the possible configuration parameters, use the /config command.

[github-actions]

Summary:

• License scan: failure
• Credentials scan: success
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: success

[YiscahLevySilas1]

@rcohencyberarmor most of these are relevant for files as well

[github-actions]

Summary:

• License scan: failure
• Credentials scan: success
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: success

[rcohencyberarmor]

@YiscahLevySilas1 which of those are relevant for files?

[github-advanced-security]

kubescape found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.

[github-actions]

Summary:

• License scan: failure
• Credentials scan: success
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: success

[YiscahLevySilas1]

@YiscahLevySilas1 which of those are relevant for files?

controls that use only k8s resources are applicable for files as well, controls that use host scanner resources are not (rules that use apigroup "hostdata.kubescape.cloud")