adapt kube-bench scan for containerized k3d

2026-08-11 17:35:00 -04:00
parent 78504c7378
commit 3256a0b93b
3 changed files with 15 additions and 1 deletions
@@ -16,6 +16,11 @@ fails if the scanner job or report generation fails. It does not yet fail on
 CIS findings because a vanilla K3d cluster is expected to produce findings;
 later hardening phases can turn selected controls into merge gates.

+Checks 1.4.1 and 1.4.2 are skipped in this CI profile because they require
+`journalctl`, while the disposable K3d control-plane node runs as a container
+without a systemd journal. These checks remain relevant for the Flatcar and
+cloud K3s deployment paths.
+
 To run the same scan locally against the active K3d cluster:

 ```bash