adapt kube-bench scan for containerized k3d

2026-08-11 17:35:00 -04:00
parent 78504c7378
commit 3256a0b93b
3 changed files with 15 additions and 1 deletions
@@ -28,6 +28,13 @@ spec:
            - run
            - --benchmark
            - k3s-cis-1.7
+            # K3d control-plane nodes run in containers without systemd journals.
+            # These checks require journalctl and are not applicable to this CI topology.
+            - --skip
+            - 1.4.1,1.4.2
+            # CI publishes findings as an artifact. Findings are not a merge gate yet.
+            - --exit-code
+            - "0"
            - --json
          securityContext:
            privileged: true