From e73fb855bdf559882bb7fc46811a92eb9f3c5d0b Mon Sep 17 00:00:00 2001 From: Cédric Ollivier Date: Sun, 13 Sep 2020 14:53:26 +0200 Subject: Split kube-bench master and node MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The former deployment asked for all-in-one. Change-Id: I12e470cec9e82b82c6f3ea5ff2431087f5deb9be Signed-off-by: Cédric Ollivier (cherry picked from commit bced94b6fe24c7e939fb22834deb77477e4a9bb9) --- .../security/kube-bench-master.yaml | 42 +++++++++++++++++ functest_kubernetes/security/kube-bench-node.yaml | 42 +++++++++++++++++ functest_kubernetes/security/kube-bench.yaml | 52 ---------------------- functest_kubernetes/security/security.py | 5 +-- 4 files changed, 85 insertions(+), 56 deletions(-) create mode 100644 functest_kubernetes/security/kube-bench-master.yaml create mode 100644 functest_kubernetes/security/kube-bench-node.yaml delete mode 100644 functest_kubernetes/security/kube-bench.yaml (limited to 'functest_kubernetes') diff --git a/functest_kubernetes/security/kube-bench-master.yaml b/functest_kubernetes/security/kube-bench-master.yaml new file mode 100644 index 00000000..755e2923 --- /dev/null +++ b/functest_kubernetes/security/kube-bench-master.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: kube-bench-master +spec: + template: + spec: + hostPID: true + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule + containers: + - name: kube-bench + image: aquasec/kube-bench:0.3.1 + command: ["kube-bench", "master", "--json"] + volumeMounts: + - name: var-lib-etcd + mountPath: /var/lib/etcd + readOnly: true + - name: etc-kubernetes + mountPath: /etc/kubernetes + readOnly: true + # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. + # You can omit this mount if you specify --version as part of the command. + - name: usr-bin + mountPath: /usr/local/mount-from-host/bin + readOnly: true + restartPolicy: Never + volumes: + - name: var-lib-etcd + hostPath: + path: "/var/lib/etcd" + - name: etc-kubernetes + hostPath: + path: "/etc/kubernetes" + - name: usr-bin + hostPath: + path: "/usr/bin" diff --git a/functest_kubernetes/security/kube-bench-node.yaml b/functest_kubernetes/security/kube-bench-node.yaml new file mode 100644 index 00000000..306ad600 --- /dev/null +++ b/functest_kubernetes/security/kube-bench-node.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: kube-bench-node +spec: + template: + spec: + hostPID: true + containers: + - name: kube-bench + image: aquasec/kube-bench:0.3.1 + command: ["kube-bench", "node", "--json"] + volumeMounts: + - name: var-lib-kubelet + mountPath: /var/lib/kubelet + readOnly: true + - name: etc-systemd + mountPath: /etc/systemd + readOnly: true + - name: etc-kubernetes + mountPath: /etc/kubernetes + readOnly: true + # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. + # You can omit this mount if you specify --version as part of the command. + - name: usr-bin + mountPath: /usr/local/mount-from-host/bin + readOnly: true + restartPolicy: Never + volumes: + - name: var-lib-kubelet + hostPath: + path: "/var/lib/kubelet" + - name: etc-systemd + hostPath: + path: "/etc/systemd" + - name: etc-kubernetes + hostPath: + path: "/etc/kubernetes" + - name: usr-bin + hostPath: + path: "/usr/bin" diff --git a/functest_kubernetes/security/kube-bench.yaml b/functest_kubernetes/security/kube-bench.yaml deleted file mode 100644 index 2f2c57d6..00000000 --- a/functest_kubernetes/security/kube-bench.yaml +++ /dev/null @@ -1,52 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: kube-bench -spec: - template: - metadata: - labels: - app: kube-bench - spec: - hostPID: true - containers: - - name: kube-bench - image: aquasec/kube-bench:0.3.1 - command: ["kube-bench"] - args: ["--json"] - volumeMounts: - - name: var-lib-etcd - mountPath: /var/lib/etcd - readOnly: true - - name: var-lib-kubelet - mountPath: /var/lib/kubelet - readOnly: true - - name: etc-systemd - mountPath: /etc/systemd - readOnly: true - - name: etc-kubernetes - mountPath: /etc/kubernetes - readOnly: true - # /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. - # You can omit this mount if you specify --version as part of the command. - - name: usr-bin - mountPath: /usr/local/mount-from-host/bin - readOnly: true - restartPolicy: Never - volumes: - - name: var-lib-etcd - hostPath: - path: "/var/lib/etcd" - - name: var-lib-kubelet - hostPath: - path: "/var/lib/kubelet" - - name: etc-systemd - hostPath: - path: "/etc/systemd" - - name: etc-kubernetes - hostPath: - path: "/etc/kubernetes" - - name: usr-bin - hostPath: - path: "/usr/bin" diff --git a/functest_kubernetes/security/security.py b/functest_kubernetes/security/security.py index 64aa4150..e590d059 100644 --- a/functest_kubernetes/security/security.py +++ b/functest_kubernetes/security/security.py @@ -191,11 +191,8 @@ class KubeBench(SecurityTesting): __logger = logging.getLogger(__name__) - def __init__(self, **kwargs): - super(KubeBench, self).__init__(**kwargs) - self.job_name = "kube-bench" - def run(self, **kwargs): + self.job_name = "kube-bench-{}".format(kwargs.get("target", "node")) super(KubeBench, self).run(**kwargs) self.details["report"] = ast.literal_eval(self.pod_log) msg = prettytable.PrettyTable( -- cgit 1.2.3-korg