emit clean kube-bench JSON report

.github/workflows/kube-bench-scan.yml

@@ -74,19 +74,11 @@ jobs:
           kubectl apply -f ci/kube-bench-k3s-job.yaml
           kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s
           job_rc=$?
-          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.raw || true
+          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true
-          awk '
-            BEGIN {capture = 0}
-            !capture && index($0, "{") > 0 {
-              sub(/^[^{]*/, "")
-              capture = 1
-            }
-            capture {print}
-          ' artifacts/kube-bench-k3s-cis-1.7.raw > artifacts/kube-bench-k3s-cis-1.7.json
 
           if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then
             echo "kube-bench did not produce valid JSON" >&2
-            cat artifacts/kube-bench-k3s-cis-1.7.raw
+            cat artifacts/kube-bench-k3s-cis-1.7.json
             exit 1
           fi
 

ci/kube-bench-k3s-job.yaml

@@ -24,18 +24,22 @@ spec:
         - name: kube-bench
           image: docker.io/aquasec/kube-bench:v0.16.0
           command:
-            - kube-bench
+            - /bin/sh
-            - run
+            - -c
-            - --benchmark
+            - |
-            - k3s-cis-1.7
+              set +e
-            # K3d control-plane nodes run in containers without systemd journals.
+              kube-bench run \
-            # These checks require journalctl and are not applicable to this CI topology.
+                --benchmark k3s-cis-1.7 \
-            - --skip
+                --skip 1.4.1,1.4.2 \
-            - 1.4.1,1.4.2
+                --exit-code 0 \
-            # CI publishes findings as an artifact. Findings are not a merge gate yet.
+                --json \
-            - --exit-code
+                >/tmp/kube-bench.json 2>/tmp/kube-bench.stderr
-            - "0"
+              scan_rc=$?
-            - --json
+              cat /tmp/kube-bench.json
+              if [ "$scan_rc" -ne 0 ]; then
+                cat /tmp/kube-bench.stderr >&2
+              fi
+              exit "$scan_rc"
           securityContext:
             privileged: true
           volumeMounts: