[jaipatel11x]

Description

Adds a Kubernetes compliance page to the Chef Compliance solution, at /solutions/compliance/kubernetes/ (sidebar: Kubernetes compliance, under overview/solutions/compliance, weight 10, after the GitHub pages and the VM compliance page in #4782).

The page covers:

• Who it's for: what Chef Compliance gives you for Kubernetes, what it doesn't (InSpec assesses configuration and doesn't enforce it), and the evidence you can hand to an auditor.
• What Chef covers: the Kubernetes resource pack for your own controls, CIS Kubernetes remediation content (v1.5.0, v1.6.1, v1.12.0), and that no prebuilt CIS Kubernetes audit content is published.
• A three-control profile: namespaces exist, each namespace has a network policy, and one container uses a pinned image tag. It's run with inspec exec -t k8s://.
• Results, fix and reassess, waivers: real output from a test cluster, a fix-and-reassess loop, and an approved exception with a waiver.
• Scheduling and drift: how to compare runs, and what to store as evidence.
• Extending the profile: the resource pack's resources, plus a securityContext example.

The page links to the other Compliance solution pages for exit codes, waivers, and custom checks instead of repeating them. Custom-checks links use /solutions/compliance/custom_compliance_checks/, matching the GitHub pages on this branch.

Definition of Done

• The page renders in a local build.
• The profile was run against a local kind cluster with Chef InSpec 5.24.7. The pass and fail output, the waiver run, and the fix-and-reassess run on the page come from that cluster. The securityContext filter was run and works as documented.
• inspec check needs inspec vendor first because of the URL dependency. The page says so.
• External /latest/ and resource pack links return 200 on docs.chef.io.

Issues Resolved

None.

Related PRs

• Solutions Page - Compliance - Phase 1 #4760
• [draft] Solutions Page - Compliance - Phase 2 #4781
• Add The Chef way of virtual machine compliance page #4782

Notes for reviewers

• Pages not on this branch yet: the page links to Compliance pages that aren't on HMS/solution-pages yet: the overview, the SSH page, and the Premium Content coverage pages. The GitHub pages here already link to /solutions/compliance/ the same way. Those links resolve once the pages land.
• No link edits in other files: the overview doesn't exist on this branch, so the link to this page from the overview isn't included. Add it when the overview lands.
• Automate scan jobs: the Scan Jobs docs don't list a Kubernetes target, so the page schedules runs from a pipeline and tells readers to confirm Automate integration with Chef support. Please confirm with the Automate team if this has changed.
• Audit coverage: the Containers / Kubernetes coverage table lists CIS Kubernetes as remediation only. The page repeats that and links to the table instead of stating more.
• Local environment: on my Workstation (InSpec 5.24.7, train-kubernetes 0.2.1), the run needed a gem workaround for a Yajl::Parser load error. I treated it as a local problem and didn't document it.
• Vale: the one error is fixed. About 28 write-good and Microsoft warnings remain, mostly passive voice and "requirement is too wordy".

Check List

• Spell Check (cspell: 0 issues)
• Local build
• Examine the local build
• All tests pass