aboutsummaryrefslogtreecommitdiffstats
path: root/functest_kubernetes/security/kube-bench-node.yaml
diff options
context:
space:
mode:
authorCédric Ollivier <cedric.ollivier@orange.com>2020-09-13 14:53:26 +0200
committerCédric Ollivier <cedric.ollivier@orange.com>2020-09-13 14:58:47 +0200
commitbced94b6fe24c7e939fb22834deb77477e4a9bb9 (patch)
tree5d36140197daa7e2b8d6d3280f8653bfe380e6a9 /functest_kubernetes/security/kube-bench-node.yaml
parentb866c73d70079fdb52e5fc999f49a32d2af82349 (diff)
Split kube-bench master and node
The former deployment asked for all-in-one. Change-Id: I12e470cec9e82b82c6f3ea5ff2431087f5deb9be Signed-off-by: Cédric Ollivier <cedric.ollivier@orange.com>
Diffstat (limited to 'functest_kubernetes/security/kube-bench-node.yaml')
-rw-r--r--functest_kubernetes/security/kube-bench-node.yaml42
1 files changed, 42 insertions, 0 deletions
diff --git a/functest_kubernetes/security/kube-bench-node.yaml b/functest_kubernetes/security/kube-bench-node.yaml
new file mode 100644
index 00000000..306ad600
--- /dev/null
+++ b/functest_kubernetes/security/kube-bench-node.yaml
@@ -0,0 +1,42 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: kube-bench-node
+spec:
+ template:
+ spec:
+ hostPID: true
+ containers:
+ - name: kube-bench
+ image: aquasec/kube-bench:0.3.1
+ command: ["kube-bench", "node", "--json"]
+ volumeMounts:
+ - name: var-lib-kubelet
+ mountPath: /var/lib/kubelet
+ readOnly: true
+ - name: etc-systemd
+ mountPath: /etc/systemd
+ readOnly: true
+ - name: etc-kubernetes
+ mountPath: /etc/kubernetes
+ readOnly: true
+ # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
+ # You can omit this mount if you specify --version as part of the command.
+ - name: usr-bin
+ mountPath: /usr/local/mount-from-host/bin
+ readOnly: true
+ restartPolicy: Never
+ volumes:
+ - name: var-lib-kubelet
+ hostPath:
+ path: "/var/lib/kubelet"
+ - name: etc-systemd
+ hostPath:
+ path: "/etc/systemd"
+ - name: etc-kubernetes
+ hostPath:
+ path: "/etc/kubernetes"
+ - name: usr-bin
+ hostPath:
+ path: "/usr/bin"