Commit 3e0d192b authored by Ruben ten Hove's avatar Ruben ten Hove
Browse files

Update k8s/kube-bench.yml

parent 2d9a13e3

k8s/kube-bench.yml

+5 −3
Original line number Diff line number Diff line
@@ -2,7 +2,6 @@ 
variables:

  KUBE_BENCH_VERSION: main  # Or use for example v0.6.7 from the available tags on https://github.com/aquasecurity/kube-bench/tags

  KUBE_BENCH_MANIFEST: https://raw.githubusercontent.com/aquasecurity/kube-bench/${KUBE_BENCH_VERSION}/job.yaml

  # KUBE_BENCH_JOB_NAME: kube-bench  # Needs to match the metadata name in the job manifest



k8s:kube-bench:prepare:

  stage: .pre
@@ -11,9 +10,12 @@ k8s:kube-bench:prepare: 
    - apk add --no-cache yq

    - wget -O job.yaml ${KUBE_BENCH_MANIFEST}

    - yq eval -i '.spec.template.spec.containers[0].command = ["kube-bench", "--junit", "--alsologtostderr", "--outputfile", "kube-bench.xml"]' job.yaml

    - echo "KUBE_BENCH_NAME=$(yq eval .metadata.name job.yaml)" > KUBE_BENCH_NAME.env

  artifacts:

    paths:

      - job.yaml

    reports:

      dotenv: KUBE_BENCH_NAME.env



k8s:kube-bench:

  stage: test
@@ -23,8 +25,8 @@ k8s:kube-bench: 
    - kubectl delete -f job.yaml --ignore-not-found=true

    - kubectl apply -f job.yaml

    - kubectl wait -f job.yaml --for=condition=complete=true

    # - kubectl logs -f jobs/${KUBE_BENCH_JOB_NAME}

    - kubectl delete -f job.yaml --ignore-not-found=true

    - kubectl logs -f jobs/${KUBE_BENCH_NAME}

    - if [ -z ${KUBE_BENCH_KEEP_JOB} ]; then kubectl delete -f job.yaml --ignore-not-found=true; fi

  needs: ["k8s:kube-bench:prepare"]

  artifacts:

    reports: