feat: ocp-1.6 compliance cis support

commands/kubernetes/kubeAPIServerSpecFileOwnershipOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0052
+  key: kubeAPIServerSpecFileOwnership
+  title: API server pod specification file ownership
+  nodeType: master
+  audit: for i in $( oc get pods -n openshift-kube-apiserver -l app=openshift-kube-apiserver -o name );do oc exec -n openshift-kube-apiserver $i -- stat -c %U:%G /etc/kubernetes/static-pod-resources/kube-apiserver-pod.yaml; done
+  platforms:
+    - ocp

commands/kubernetes/kubeAPIServerSpecFilePermissionOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0051
+  key: kubeAPIServerSpecFilePermission
+  title: API server pod specification file permissions
+  nodeType: master
+  audit: for i in $( oc get pods -n openshift-kube-apiserver -l app=openshift-kube-apiserver -o name ); do oc exec -n openshift-kube-apiserver $i --  stat -c %a /etc/kubernetes/static-pod-resources/kube-apiserver-pod.yaml; done
+  platforms:
+    - ocp

commands/kubernetes/kubeControllerManagerSpecFileOwnershipOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0054
+  key: kubeControllerManagerSpecFileOwnership
+  title: Controller manager pod specification file ownership is set to root:root
+  nodeType: master
+  audit: for i in $( oc get pods -n openshift-kube-controller-manager -o name -l app=kube-controller-manager);do oc exec -n openshift-kube-controller-manager $i -- stat -c %U:%G /etc/kubernetes/static-pod-resources/kube-controller-manager-pod.yaml;done
+  platforms:
+    - ocp

commands/kubernetes/kubeControllerManagerSpecFilePermissionOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0053
+  key: kubeControllerManagerSpecFilePermission
+  title: Controller manager pod specification file permissions
+  nodeType: master
+  audit: for i in $( oc get pods -n openshift-kube-controller-manager -o name -l app=kube-controller-manager); do oc exec -n openshift-kube-controller-manager $i -- stat -c %a /etc/kubernetes/static-pod-resources/kube-controller-manager-pod.yaml; done
+  platforms:
+    - ocp

commands/kubernetes/kubeEtcdSpecFileOwnershipOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0058
+  key: kubeEtcdSpecFileOwnership
+  title: Etcd pod specification file ownership
+  nodeType: master
+  audit: for i in $(oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd );do oc rsh -n openshift-etcd $i stat -c %U:%G /etc/kubernetes/manifests/etcd-pod.yaml;done
+  platforms:
+    - ocp

commands/kubernetes/kubeEtcdSpecFilePermissionOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0057
+  key: kubeEtcdSpecFilePermission
+  title: Etcd pod specification file permissions
+  nodeType: master
+  audit: for i in $(oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd );do oc rsh -n openshift-etcd $i stat -c %a /etc/kubernetes/manifests/etcd-pod.yaml;done
+  platforms:
+    - ocp

commands/kubernetes/kubeSchedulerSpecFileOwnershipOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0056
+  key: kubeSchedulerSpecFileOwnership
+  title: Scheduler pod specification file ownership
+  nodeType: master
+  audit: for i in $(oc get pods -n openshift-kube-scheduler -l app=openshift-kube-scheduler -o name);do oc exec -n openshift-kube-scheduler $i -- stat -c %U:%G /etc/kubernetes/static-pod-resources/kube-scheduler-pod.yaml;done
+  platforms:
+    - ocp

commands/kubernetes/kubeSchedulerSpecFilePermissionOcp.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0055
+  key: kubeSchedulerSpecFilePermission
+  title: Scheduler pod specification file permissions
+  nodeType: master
+  audit: for i in $(oc get pods -n openshift-kube-scheduler -l app=openshift-kube-scheduler -o name);do oc exec -n openshift-kube-scheduler $i -- stat -c %a /etc/kubernetes/static-pod-resources/kube-scheduler-pod.yaml;done
+  platforms:
+    - ocp

pkg/specs/compliance/ocp-cis-1.6.0.yaml

@@ -0,0 +1,22 @@
+---
+spec:
+  id: ocp-cis-1.6.0
+  title: CIS Red Hat OpenShift Container Platform Benchmark 1.6.0
+  description: CIS Red Hat OpenShift Container Platform Benchmark 1.6.0
+  version: "1.6.0"
+  platfrom: ocp
+  type: cis
+  relatedResources:
+    - https://www.cisecurity.org/benchmark/kubernetes
+  controls:
+    - id: 1.1.1
+      name: Ensure that the API server pod specification file permissions are set to
+        600 or more restrictive
+      description: Ensure that the API server pod specification file has permissions
+        of 600 or more restrictive
+      checks:
+        - id: AVD-KCV-0048
+      commands:
+        - id: CMD-0051
+      severity: HIGH
+