diff options
Diffstat (limited to 'functest_kubernetes')
| -rw-r--r-- | functest_kubernetes/security/kube-bench-master.yaml | 42 | ||||
| -rw-r--r-- | functest_kubernetes/security/kube-bench-node.yaml (renamed from functest_kubernetes/security/kube-bench.yaml) | 14 | ||||
| -rw-r--r-- | functest_kubernetes/security/security.py | 5 |
3 files changed, 45 insertions, 16 deletions
diff --git a/functest_kubernetes/security/kube-bench-master.yaml b/functest_kubernetes/security/kube-bench-master.yaml new file mode 100644 index 00000000..755e2923 --- /dev/null +++ b/functest_kubernetes/security/kube-bench-master.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: kube-bench-master +spec: + template: + spec: + hostPID: true + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule + containers: + - name: kube-bench + image: aquasec/kube-bench:0.3.1 + command: ["kube-bench", "master", "--json"] + volumeMounts: + - name: var-lib-etcd + mountPath: /var/lib/etcd + readOnly: true + - name: etc-kubernetes + mountPath: /etc/kubernetes + readOnly: true + # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. + # You can omit this mount if you specify --version as part of the command. + - name: usr-bin + mountPath: /usr/local/mount-from-host/bin + readOnly: true + restartPolicy: Never + volumes: + - name: var-lib-etcd + hostPath: + path: "/var/lib/etcd" + - name: etc-kubernetes + hostPath: + path: "/etc/kubernetes" + - name: usr-bin + hostPath: + path: "/usr/bin" diff --git a/functest_kubernetes/security/kube-bench.yaml b/functest_kubernetes/security/kube-bench-node.yaml index 2f2c57d6..306ad600 100644 --- a/functest_kubernetes/security/kube-bench.yaml +++ b/functest_kubernetes/security/kube-bench-node.yaml @@ -2,23 +2,16 @@ apiVersion: batch/v1 kind: Job metadata: - name: kube-bench + name: kube-bench-node spec: template: - metadata: - labels: - app: kube-bench spec: hostPID: true containers: - name: kube-bench image: aquasec/kube-bench:0.3.1 - command: ["kube-bench"] - args: ["--json"] + command: ["kube-bench", "node", "--json"] volumeMounts: - - name: var-lib-etcd - mountPath: /var/lib/etcd - readOnly: true - name: var-lib-kubelet mountPath: /var/lib/kubelet readOnly: true @@ -35,9 +28,6 @@ spec: readOnly: true restartPolicy: Never volumes: - - name: var-lib-etcd - hostPath: - path: "/var/lib/etcd" - name: var-lib-kubelet hostPath: path: "/var/lib/kubelet" diff --git a/functest_kubernetes/security/security.py b/functest_kubernetes/security/security.py index 64aa4150..e590d059 100644 --- a/functest_kubernetes/security/security.py +++ b/functest_kubernetes/security/security.py @@ -191,11 +191,8 @@ class KubeBench(SecurityTesting): __logger = logging.getLogger(__name__) - def __init__(self, **kwargs): - super(KubeBench, self).__init__(**kwargs) - self.job_name = "kube-bench" - def run(self, **kwargs): + self.job_name = "kube-bench-{}".format(kwargs.get("target", "node")) super(KubeBench, self).run(**kwargs) self.details["report"] = ast.literal_eval(self.pod_log) msg = prettytable.PrettyTable( |