☂ Implement Garden provider & Security Hardened Shoot Cluster ruleset

[AleksandarSavchev]

What would you like to be added:
A Garden provider that has access to the garden cluster can be implemented:

• Add Garden provider Add Garden provider #305

A new ruleset should also be created for the Garden provider. This ruleset can be named Security Hardened Shoot Cluster which checks targeted Shoot resource by Project and Shoot name. The ruleset should reference DISA K8s STIG rules, which can be checked in the Shoot spec and also add additional rules.

• Add Security Hardened Shoot Cluster ruleset guide Add Security Hardened Shoot Cluster ruleset version v0.1.0  #308

• Implement rules

  • 1000 Shoot clusters should enable required extensions.
    • [Security Hardened Shoot Cluster] Rule 1000 Implementation #381
    • [Security Hardened Shoot Cluster] Rule 1000 check Shoot labels #398
  • 2000 Shoot clusters must have anonymous authentication disabled for the Kubernetes API server. [Security Hardened Shoot Cluster] Rule 2000 Implementation #362
  • 2001 Kubernetes Worker Nodes must have ssh access disabled. [Security Hardened Shoot Cluster] Rule 2001 Implementation #358
  • 2002 Shoot clusters must not have Alpha APIs enabled for any Kubernetes component. [Security Hardened Shoot Cluster] Rule 2002 Implementation #360
  • 2003 Shoot clusters must enable kernel protection for Kubelets. [Security Hardened Shoot Cluster] Rule 2003 implementation #343
  • 2004 Shoot clusters must have ValidatingAdmissionWebhook admission plugin enabled. [Security Hardened Shoot Cluster] Rule 2004 Implementation #365
  • 2005 Shoot clusters must not disable timeouts for Kubelet. [Security Hardened Shoot Cluster] Rule 2005 Implementation #363
  • 2006 Shoot clusters must have static token kubeconfig disabled. [Security Hardened Shoot Cluster] Rule 2006 Implementation #366
  • 2007 Shoot clusters must have a PodSecurity admission plugin configured. [Security Hardened Shoot Cluster] Rule 2007 Implementation #374

Update usage documentation:

• add new usage documentation for running the Security Hardened Shoot Cluster ruleset Add usage documentation #384

[AleksandarSavchev]

/assign @georgibaltiev

[dimityrmirchev]

/close