emit clean kube-bench JSON report

2026-08-11 19:00:11 -04:00
parent 992f2e2b07
commit 3b1ca2a468
2 changed files with 18 additions and 22 deletions
@@ -24,18 +24,22 @@ spec:
        - name: kube-bench
          image: docker.io/aquasec/kube-bench:v0.16.0
          command:
-            - kube-bench
-            - run
-            - --benchmark
-            - k3s-cis-1.7
-            # K3d control-plane nodes run in containers without systemd journals.
-            # These checks require journalctl and are not applicable to this CI topology.
-            - --skip
-            - 1.4.1,1.4.2
-            # CI publishes findings as an artifact. Findings are not a merge gate yet.
-            - --exit-code
-            - "0"
-            - --json
+            - /bin/sh
+            - -c
+            - |
+              set +e
+              kube-bench run \
+                --benchmark k3s-cis-1.7 \
+                --skip 1.4.1,1.4.2 \
+                --exit-code 0 \
+                --json \
+                >/tmp/kube-bench.json 2>/tmp/kube-bench.stderr
+              scan_rc=$?
+              cat /tmp/kube-bench.json
+              if [ "$scan_rc" -ne 0 ]; then
+                cat /tmp/kube-bench.stderr >&2
+              fi
+              exit "$scan_rc"
          securityContext:
            privileged: true
          volumeMounts: