swaphb/kubernetes-security-baseline-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

normalize kube-bench output before validation
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Failing after 2m45s
Details

Browse Source
This commit is contained in:
swaphb
2026-08-11 17:45:29 -04:00
parent 3256a0b93b
commit f7fb479631
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/kube-bench-scan.yml
+10 -2
View File
@@ -74,11 +74,19 @@ jobs:
kubectl apply -f ci/kube-bench-k3s-job.yaml kubectl apply -f ci/kube-bench-k3s-job.yaml
kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s
job_rc=$? job_rc=$?
kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.raw || true
awk '
BEGIN {capture = 0}
!capture && index($0, "{") > 0 {
sub(/^.*\{/, "{")
capture = 1
}
capture {print}
' artifacts/kube-bench-k3s-cis-1.7.raw > artifacts/kube-bench-k3s-cis-1.7.json
if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then
echo "kube-bench did not produce valid JSON" >&2 echo "kube-bench did not produce valid JSON" >&2
cat artifacts/kube-bench-k3s-cis-1.7.json cat artifacts/kube-bench-k3s-cis-1.7.raw
exit 1 exit 1
fi fi