diff options
Diffstat (limited to 'functest_kubernetes/security/kube-bench-master.yaml')
| -rw-r--r-- | functest_kubernetes/security/kube-bench-master.yaml | 79 |
1 files changed, 75 insertions, 4 deletions
diff --git a/functest_kubernetes/security/kube-bench-master.yaml b/functest_kubernetes/security/kube-bench-master.yaml index d1a13217..ccfc842b 100644 --- a/functest_kubernetes/security/kube-bench-master.yaml +++ b/functest_kubernetes/security/kube-bench-master.yaml @@ -7,20 +7,49 @@ spec: template: spec: hostPID: true - nodeSelector: - node-role.kubernetes.io/master: "" + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: Exists + - matchExpressions: + - key: node-role.kubernetes.io/master + operator: Exists tolerations: - key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule containers: - name: kube-bench - image: {{ dockerhub_repo }}/aquasec/kube-bench:0.3.1 - command: ["kube-bench", "master", "--json"] + image: {{ dockerhub_repo }}/aquasec/kube-bench:latest + command: ["kube-bench", "run", "--targets", "master", "--json"] volumeMounts: - name: var-lib-etcd mountPath: /var/lib/etcd readOnly: true + - name: var-lib-kubelet + mountPath: /var/lib/kubelet + readOnly: true + - name: var-lib-kube-scheduler + mountPath: /var/lib/kube-scheduler + readOnly: true + - name: var-lib-kube-controller-manager + mountPath: /var/lib/kube-controller-manager + readOnly: true + - name: etc-systemd + mountPath: /etc/systemd + readOnly: true + - name: lib-systemd + mountPath: /lib/systemd/ + readOnly: true + - name: srv-kubernetes + mountPath: /srv/kubernetes/ + readOnly: true - name: etc-kubernetes mountPath: /etc/kubernetes readOnly: true @@ -29,14 +58,56 @@ spec: - name: usr-bin mountPath: /usr/local/mount-from-host/bin readOnly: true + - name: etc-cni-netd + mountPath: /etc/cni/net.d/ + readOnly: true + - name: opt-cni-bin + mountPath: /opt/cni/bin/ + readOnly: true + - name: etc-passwd + mountPath: /etc/passwd + readOnly: true + - name: etc-group + mountPath: /etc/group + readOnly: true restartPolicy: Never volumes: - name: var-lib-etcd hostPath: path: "/var/lib/etcd" + - name: var-lib-kubelet + hostPath: + path: "/var/lib/kubelet" + - name: var-lib-kube-scheduler + hostPath: + path: "/var/lib/kube-scheduler" + - name: var-lib-kube-controller-manager + hostPath: + path: "/var/lib/kube-controller-manager" + - name: etc-systemd + hostPath: + path: "/etc/systemd" + - name: lib-systemd + hostPath: + path: "/lib/systemd" + - name: srv-kubernetes + hostPath: + path: "/srv/kubernetes" - name: etc-kubernetes hostPath: path: "/etc/kubernetes" - name: usr-bin hostPath: path: "/usr/bin" + - name: etc-cni-netd + hostPath: + path: "/etc/cni/net.d/" + - name: opt-cni-bin + hostPath: + path: "/opt/cni/bin/" + - name: etc-passwd + hostPath: + path: "/etc/passwd" + - name: etc-group + hostPath: + path: "/etc/group" |