kube-bench-plugin.yaml

podSpec:
  containers: []
  dnsPolicy: ClusterFirstWithHostNet
  hostIPC: true
  hostNetwork: true
  hostPID: true
  serviceAccountName: sonobuoy-serviceaccount
  tolerations:
  - operator: Exists
  volumes:
  - name: var-lib-etcd
    hostPath:
      path: "/var/lib/etcd"
  - name: var-lib-kubelet
    hostPath:
      path: "/var/lib/kubelet"
  - name: lib-systemd
    hostPath:
      path: "/lib/systemd"
  - name: etc-systemd
    hostPath:
      path: "/etc/systemd"
  - name: etc-kubernetes
    hostPath:
      path: "/etc/kubernetes"
  # Uncomment this volume definition if you wish to use Kubernetes version auto-detection in kube-bench.
  # - name: usr-bin
  #   hostPath:
  #     path: "/usr/bin"
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: node-role.kubernetes.io/master
            operator: DoesNotExist
sonobuoy-config:
  driver: DaemonSet
  plugin-name: kube-bench-node
  result-format: junit
spec:
  command:
  - /bin/sh
  args:
  - -c
  - /run-kube-bench.sh; while true; do echo "Sleeping for 1h to avoid daemonset restart"; /bin/sleep 3600; done
  env:
    - name: KUBERNETES_VERSION
      value: "1.19"
    - name: TARGET_MASTER
      value: "false"
    - name: TARGET_NODE
      value: "true"
    - name: TARGET_CONTROLPLANE
      value: "false"
    - name: TARGET_ETCD
      value: "false"
    - name: TARGET_POLICIES
      value: "false"
  image: sonobuoy/kube-bench:v0.8.0
  name: plugin
  resources: {}
  volumeMounts:
  - mountPath: /tmp/sonobuoy/results
    name: results
  - name: var-lib-etcd
    mountPath: /var/lib/etcd
    readOnly: true
  - name: var-lib-kubelet
    mountPath: /var/lib/kubelet
    readOnly: true
  - name: lib-systemd
    mountPath: /lib/systemd
    readOnly: true
  - name: etc-systemd
    mountPath: /etc/systemd
    readOnly: true
  - name: etc-kubernetes
    mountPath: /etc/kubernetes
    readOnly: true
  # /usr/bin is mounted to access kubectl / kubelet, used by kube-bench for auto-detecting the Kubernetes version.
  # It is mounted at the path /usr/local/mount-from-host/bin to avoid overwriting /usr/bin within the container.
  # You can omit this mount if you provide the version using the KUBERNETES_VERSION environment variable.
  # - name: usr-bin
  #   mountPath: /usr/local/mount-from-host/bin
  #   readOnly: true