Add CI

2026-08-09 21:46:33 -04:00
parent a49903fbe8
commit 8955ba6873
4 changed files with 201 additions and 1 deletions
@@ -0,0 +1,65 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kube-bench
+  namespace: kube-bench
+  labels:
+    app.kubernetes.io/name: kube-bench
+    app.kubernetes.io/part-of: kubernetes-security-baseline
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kube-bench
+    spec:
+      # The K3s CIS profile checks host processes and node configuration.
+      hostPID: true
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: "true"
+      tolerations:
+        - operator: Exists
+      restartPolicy: Never
+      containers:
+        - name: kube-bench
+          image: docker.io/aquasec/kube-bench:v0.16.0
+          command:
+            - kube-bench
+            - run
+            - --benchmark
+            - k3s-cis-1.7
+            - --json
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: etc-rancher-k3s
+              mountPath: /etc/rancher/k3s
+              readOnly: true
+            - name: var-lib-rancher-k3s
+              mountPath: /var/lib/rancher/k3s
+              readOnly: true
+            - name: var-lib-kubelet
+              mountPath: /var/lib/kubelet
+              readOnly: true
+            - name: var-lib-cni
+              mountPath: /var/lib/cni
+              readOnly: true
+            - name: etc-cni-netd
+              mountPath: /etc/cni/net.d
+              readOnly: true
+      volumes:
+        - name: etc-rancher-k3s
+          hostPath:
+            path: /etc/rancher/k3s
+        - name: var-lib-rancher-k3s
+          hostPath:
+            path: /var/lib/rancher/k3s
+        - name: var-lib-kubelet
+          hostPath:
+            path: /var/lib/kubelet
+        - name: var-lib-cni
+          hostPath:
+            path: /var/lib/cni
+        - name: etc-cni-netd
+          hostPath:
+            path: /etc/cni/net.d