diff options
| author |   Cédric Ollivier <cedric.ollivier@orange.com> | 2020-09-13 14:53:26 +0200 |
|---|---|---|
| committer | Cédric Ollivier <cedric.ollivier@orange.com> | 2020-09-13 17:01:28 +0200 |
| commit | c5ffd6613f4ad87bd4fec618411cbb06c8278301 (patch) | |
| tree | 57c06c49cb40d4c08ba80f72712837b84a689b3e /functest_kubernetes/security/kube-bench-master.yaml | |
| parent | f5cd7b8964ee44a34c9764f154ce024db3ac1ef2 (diff) | |
Split kube-bench master and node
The former deployment asked for all-in-one.
Change-Id: I12e470cec9e82b82c6f3ea5ff2431087f5deb9be
Signed-off-by: Cédric Ollivier <cedric.ollivier@orange.com>
(cherry picked from commit bced94b6fe24c7e939fb22834deb77477e4a9bb9)
Diffstat (limited to 'functest_kubernetes/security/kube-bench-master.yaml')
| -rw-r--r-- | functest_kubernetes/security/kube-bench-master.yaml | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/functest_kubernetes/security/kube-bench-master.yaml b/functest_kubernetes/security/kube-bench-master.yaml new file mode 100644 index 00000000..755e2923 --- /dev/null +++ b/functest_kubernetes/security/kube-bench-master.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: kube-bench-master +spec: + template: + spec: + hostPID: true + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule + containers: + - name: kube-bench + image: aquasec/kube-bench:0.3.1 + command: ["kube-bench", "master", "--json"] + volumeMounts: + - name: var-lib-etcd + mountPath: /var/lib/etcd + readOnly: true + - name: etc-kubernetes + mountPath: /etc/kubernetes + readOnly: true + # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. + # You can omit this mount if you specify --version as part of the command. + - name: usr-bin + mountPath: /usr/local/mount-from-host/bin + readOnly: true + restartPolicy: Never + volumes: + - name: var-lib-etcd + hostPath: + path: "/var/lib/etcd" + - name: etc-kubernetes + hostPath: + path: "/etc/kubernetes" + - name: usr-bin + hostPath: + path: "/usr/bin" |