-
Dmytro Oboznyi authored
* Fix file permissions false positive Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Added kops files to config path list Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Automated CNI files checks Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fixed linting Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fixed to right folder CNI test Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Changed Automated to manual Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Removed changes from remediation Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Added path to config files Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Update cfg/cis-1.6/master.yaml Co-authored-by:
Yoav Rotem <yoavrotems97@gmail.com> Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fix Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fix to job.yaml Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Add extra mountpoints Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Revert audit scripts changes Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> Co-authored-by:
Yoav Rotem <yoavrotems97@gmail.com>
Dmytro Oboznyi authored* Fix file permissions false positive Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Added kops files to config path list Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Automated CNI files checks Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fixed linting Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fixed to right folder CNI test Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Changed Automated to manual Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Removed changes from remediation Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Added path to config files Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Update cfg/cis-1.6/master.yaml Co-authored-by:
Yoav Rotem <yoavrotems97@gmail.com> Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fix Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Fix to job.yaml Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Add extra mountpoints Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> * Revert audit scripts changes Signed-off-by:
Dmytro Oboznyi <dmytro.oboznyi@syncier.com> Co-authored-by:
Yoav Rotem <yoavrotems97@gmail.com>
job-node.yaml 2.65 KiB
---
apiVersion: batch/v1
kind: Job
metadata:
name: kube-bench-node
spec:
template:
spec:
hostPID: true
containers:
- name: kube-bench
image: aquasec/kube-bench:latest
command: ["kube-bench", "run", "--targets=node"]
volumeMounts:
- name: var-lib-etcd
mountPath: /var/lib/etcd
readOnly: true
- name: var-lib-kubelet
mountPath: /var/lib/kubelet
readOnly: true
- name: var-lib-kube-scheduler
mountPath: /var/lib/kube-scheduler
readOnly: true
- name: var-lib-kube-controller-manager
mountPath: /var/lib/kube-controller-manager
readOnly: true
- name: etc-systemd
mountPath: /etc/systemd
readOnly: true
- name: lib-systemd
mountPath: /lib/systemd/
readOnly: true
- name: srv-kubernetes
mountPath: /srv/kubernetes/
readOnly: true
- name: etc-kubernetes
mountPath: /etc/kubernetes
readOnly: true
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
# You can omit this mount if you specify --version as part of the command.
- name: usr-bin
mountPath: /usr/local/mount-from-host/bin
readOnly: true
- name: etc-cni-netd
mountPath: /etc/cni/net.d/
readOnly: true
- name: opt-cni-bin
mountPath: /opt/cni/bin/
readOnly: true
restartPolicy: Never
volumes:
- name: var-lib-etcd
hostPath:
path: "/var/lib/etcd"
- name: var-lib-kubelet
hostPath:
path: "/var/lib/kubelet"
- name: var-lib-kube-scheduler
hostPath:
path: "/var/lib/kube-scheduler"
- name: var-lib-kube-controller-manager
hostPath:
path: "/var/lib/kube-controller-manager"
- name: etc-systemd
hostPath:
path: "/etc/systemd"
- name: lib-systemd
hostPath:
path: "/lib/systemd"
- name: srv-kubernetes