Add CIS 2.1 self-assessment guide

[Vamsi-344]

Summary

Updates the K3s security documentation for CIS Kubernetes Benchmark v2.1.0.

• Adds a CIS 2.1 self-assessment guide for K3s v1.36-v1.37
• Updates the security index, sidebar, and /security/self-assessment redirect to include the CIS 2.1 guide
• Updates hardening guide references for the latest self-assessment
• Adds untranslated zh/ja placeholders for the new self-assessment page

Notable CIS 2.1 changes covered

The CIS Kubernetes Benchmark v2.1.0 changelog notes support for Kubernetes v1.36/v1.37, updated references/links, remediation/audit edits for 4.2.12, and removal of insecure ciphers from recommendations.

Compared with the existing K3s CIS 1.12 self-assessment, this adds the following controls/sections:

• 3.1.1 Client certificate authentication should not be used for users
• 3.1.2 Service account token authentication should not be used for users
• 3.1.3 Bootstrap token authentication should not be used for users
• 3.2.1 Ensure that a minimal audit policy is created
• 3.2.2 Ensure that the audit policy covers key security concerns
• 4.1.11 Ensure that the kubelet drop-in configuration directory and files have restrictive permissions
• 5.1.14 Ensure that access to the Kubelet API uses fine-grained subresources instead of nodes/proxy where possible
• 5.2.13 Minimize the admission of containers which have unmasked procmounts

This also updates control titles and Automated/Manual classifications to match CIS Kubernetes Benchmark v2.1.0.

References k3s-io/k3s#14739.

Validation

• npm exec corepack -- yarn build

The build completed successfully. Existing localized broken-anchor warnings are still present in zh/ja output.

Notes

I would appreciate maintainer review on whether additional validation output is needed from a hardened v1.36/v1.37 K3s cluster.

AI tooling was used to help draft and compare documentation changes. I reviewed the resulting changes before submission.

[dereknola]

This is not the process for adding cis security assessments. There is not a k3s specific configuration for cis-2.1 at this time. The latest version is k3s-cis2.0 available at https://github.com/rancher/security-scan/tree/main/package/cfg/k3s-cis-2.0 which has not yet been ported to kube-bench. Additionally, the kube-bench project does not yet have a valid cis-2.1 configuration to base the k3s specific version off.

The official procedure for adding security assessments is:

• A new generic k8s cis-2.XX is published by the CIS non-profit
• A associated version for generic k8s is added to the kube-bench project
• A new k3s specific version is derived and created based off that new version and existing k3s (n-1) versions of the benchmark. That is published first to https://github.com/rancher/security-scan/tree/main/package/cfg and then back to kube-bench (There are some slight differences in the implementations due to community workflows)
• using the new k3s specific benchmark, a json report is created using a hardened k3s cluster (following the standard hardening guide)
• The script https://github.com/k3s-io/docs/blob/main/scripts/kubebench-to-markdown.sh is used to generate the markdown equivalent of the report and a new page is added to this repo.