functest_kubernetes/security/kube-bench-master.yaml

   1 ---
   2 apiVersion: batch/v1
   3 kind: Job
   4 metadata:
   5   name: kube-bench-master
   6 spec:
   7   template:
   8     spec:
   9       hostPID: true
  10       affinity:
  11         nodeAffinity:
  12           requiredDuringSchedulingIgnoredDuringExecution:
  13             nodeSelectorTerms:
  14               - matchExpressions:
  15                   - key: node-role.kubernetes.io/control-plane
  16                     operator: Exists
  17               - matchExpressions:
  18                   - key: node-role.kubernetes.io/master
  19                     operator: Exists
  20       tolerations:
  21         - key: node-role.kubernetes.io/master
  22           operator: Exists
  23           effect: NoSchedule
  24         - key: node-role.kubernetes.io/control-plane
  25           operator: Exists
  26           effect: NoSchedule
  27       containers:
  28         - name: kube-bench
  29           image: {{ dockerhub_repo }}/aquasec/kube-bench:latest
  30           command: ["kube-bench", "run", "--targets", "master", "--json"]
  31           volumeMounts:
  32             - name: var-lib-etcd
  33               mountPath: /var/lib/etcd
  34               readOnly: true
  35             - name: var-lib-kubelet
  36               mountPath: /var/lib/kubelet
  37               readOnly: true
  38             - name: var-lib-kube-scheduler
  39               mountPath: /var/lib/kube-scheduler
  40               readOnly: true
  41             - name: var-lib-kube-controller-manager
  42               mountPath: /var/lib/kube-controller-manager
  43               readOnly: true
  44             - name: etc-systemd
  45               mountPath: /etc/systemd
  46               readOnly: true
  47             - name: lib-systemd
  48               mountPath: /lib/systemd/
  49               readOnly: true
  50             - name: srv-kubernetes
  51               mountPath: /srv/kubernetes/
  52               readOnly: true
  53             - name: etc-kubernetes
  54               mountPath: /etc/kubernetes
  55               readOnly: true
  56               # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
  57               # You can omit this mount if you specify --version as part of the command.
  58             - name: usr-bin
  59               mountPath: /usr/local/mount-from-host/bin
  60               readOnly: true
  61             - name: etc-cni-netd
  62               mountPath: /etc/cni/net.d/
  63               readOnly: true
  64             - name: opt-cni-bin
  65               mountPath: /opt/cni/bin/
  66               readOnly: true
  67             - name: etc-passwd
  68               mountPath: /etc/passwd
  69               readOnly: true
  70             - name: etc-group
  71               mountPath: /etc/group
  72               readOnly: true
  73       restartPolicy: Never
  74       volumes:
  75         - name: var-lib-etcd
  76           hostPath:
  77             path: "/var/lib/etcd"
  78         - name: var-lib-kubelet
  79           hostPath:
  80             path: "/var/lib/kubelet"
  81         - name: var-lib-kube-scheduler
  82           hostPath:
  83             path: "/var/lib/kube-scheduler"
  84         - name: var-lib-kube-controller-manager
  85           hostPath:
  86             path: "/var/lib/kube-controller-manager"
  87         - name: etc-systemd
  88           hostPath:
  89             path: "/etc/systemd"
  90         - name: lib-systemd
  91           hostPath:
  92             path: "/lib/systemd"
  93         - name: srv-kubernetes
  94           hostPath:
  95             path: "/srv/kubernetes"
  96         - name: etc-kubernetes
  97           hostPath:
  98             path: "/etc/kubernetes"
  99         - name: usr-bin
 100           hostPath:
 101             path: "/usr/bin"
 102         - name: etc-cni-netd
 103           hostPath:
 104             path: "/etc/cni/net.d/"
 105         - name: opt-cni-bin
 106           hostPath:
 107             path: "/opt/cni/bin/"
 108         - name: etc-passwd
 109           hostPath:
 110             path: "/etc/passwd"
 111         - name: etc-group
 112           hostPath:
 113             path: "/etc/group"