From 3b1ca2a4685f83b5e0888585a639af29a8361118 Mon Sep 17 00:00:00 2001
From: swaphb <s@swaphb.com>
Date: Tue, 11 Aug 2026 19:00:11 -0400
Subject: [PATCH] emit clean kube-bench JSON report

---
 .github/workflows/kube-bench-scan.yml | 12 ++----------
 ci/kube-bench-k3s-job.yaml            | 28 +++++++++++++++------------
 2 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index 21564b7..30ebe5e 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -74,19 +74,11 @@ jobs:
           kubectl apply -f ci/kube-bench-k3s-job.yaml
           kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s
           job_rc=$?
-          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.raw || true
-          awk '
-            BEGIN {capture = 0}
-            !capture && index($0, "{") > 0 {
-              sub(/^[^{]*/, "")
-              capture = 1
-            }
-            capture {print}
-          ' artifacts/kube-bench-k3s-cis-1.7.raw > artifacts/kube-bench-k3s-cis-1.7.json
+          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true
 
           if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then
             echo "kube-bench did not produce valid JSON" >&2
-            cat artifacts/kube-bench-k3s-cis-1.7.raw
+            cat artifacts/kube-bench-k3s-cis-1.7.json
             exit 1
           fi
 
diff --git a/ci/kube-bench-k3s-job.yaml b/ci/kube-bench-k3s-job.yaml
index 0281fc9..dd5df5b 100644
--- a/ci/kube-bench-k3s-job.yaml
+++ b/ci/kube-bench-k3s-job.yaml
@@ -24,18 +24,22 @@ spec:
         - name: kube-bench
           image: docker.io/aquasec/kube-bench:v0.16.0
           command:
-            - kube-bench
-            - run
-            - --benchmark
-            - k3s-cis-1.7
-            # K3d control-plane nodes run in containers without systemd journals.
-            # These checks require journalctl and are not applicable to this CI topology.
-            - --skip
-            - 1.4.1,1.4.2
-            # CI publishes findings as an artifact. Findings are not a merge gate yet.
-            - --exit-code
-            - "0"
-            - --json
+            - /bin/sh
+            - -c
+            - |
+              set +e
+              kube-bench run \
+                --benchmark k3s-cis-1.7 \
+                --skip 1.4.1,1.4.2 \
+                --exit-code 0 \
+                --json \
+                >/tmp/kube-bench.json 2>/tmp/kube-bench.stderr
+              scan_rc=$?
+              cat /tmp/kube-bench.json
+              if [ "$scan_rc" -ne 0 ]; then
+                cat /tmp/kube-bench.stderr >&2
+              fi
+              exit "$scan_rc"
           securityContext:
             privileged: true
           volumeMounts: