77 lines
2.5 KiB
YAML
77 lines
2.5 KiB
YAML
name: Kube-bench CIS scan
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
kube-bench:
|
|
name: Scan ephemeral K3s cluster
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install k3d
|
|
run: curl -sfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
|
|
|
|
- name: Create ephemeral K3s cluster
|
|
run: |
|
|
k3d cluster create --config ci/k3d-ci-cluster-config.yaml
|
|
kubectl wait --for=condition=Ready nodes --all --timeout=180s
|
|
kubectl get nodes -o wide
|
|
|
|
- name: Run kube-bench
|
|
id: scan
|
|
shell: bash
|
|
run: |
|
|
set +e
|
|
mkdir -p artifacts
|
|
kubectl create namespace kube-bench --dry-run=client -o yaml | kubectl apply -f -
|
|
kubectl apply -f ci/kube-bench-k3s-job.yaml
|
|
kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s
|
|
job_rc=$?
|
|
kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true
|
|
|
|
if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then
|
|
echo "kube-bench did not produce valid JSON" >&2
|
|
cat artifacts/kube-bench-k3s-cis-1.7.json
|
|
exit 1
|
|
fi
|
|
|
|
pass_count=$(jq '[.. | objects | select(has("total_pass")) | .total_pass] | add // 0' artifacts/kube-bench-k3s-cis-1.7.json)
|
|
warn_count=$(jq '[.. | objects | select(has("total_warn")) | .total_warn] | add // 0' artifacts/kube-bench-k3s-cis-1.7.json)
|
|
fail_count=$(jq '[.. | objects | select(has("total_fail")) | .total_fail] | add // 0' artifacts/kube-bench-k3s-cis-1.7.json)
|
|
|
|
{
|
|
echo "## kube-bench CIS K3s 1.7"
|
|
echo
|
|
echo "| Result | Count |"
|
|
echo "| --- | ---: |"
|
|
echo "| Pass | ${pass_count} |"
|
|
echo "| Warn | ${warn_count} |"
|
|
echo "| Fail | ${fail_count} |"
|
|
echo
|
|
echo "Findings are reported as an artifact. The disposable K3d baseline is not a merge gate yet."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
exit "$job_rc"
|
|
|
|
- name: Upload kube-bench report
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: kube-bench-k3s-cis-1.7
|
|
path: artifacts/kube-bench-k3s-cis-1.7.json
|
|
if-no-files-found: warn
|
|
|
|
- name: Delete ephemeral cluster
|
|
if: always()
|
|
run: k3d cluster delete security-baseline
|