apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench
  namespace: kube-bench
  labels:
    app.kubernetes.io/name: kube-bench
    app.kubernetes.io/part-of: kubernetes-security-baseline
spec:
  backoffLimit: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kube-bench
    spec:
      # The K3s CIS profile checks host processes and node configuration.
      hostPID: true
      nodeSelector:
        node-role.kubernetes.io/control-plane: "true"
      tolerations:
        - operator: Exists
      restartPolicy: Never
      containers:
        - name: kube-bench
          image: docker.io/aquasec/kube-bench:v0.16.0
          command:
            - kube-bench
            - run
            - --benchmark
            - k3s-cis-1.7
            # K3d control-plane nodes run in containers without systemd journals.
            # These checks require journalctl and are not applicable to this CI topology.
            - --skip
            - 1.4.1,1.4.2
            # CI publishes findings as an artifact. Findings are not a merge gate yet.
            - --exit-code
            - "0"
            - --json
          securityContext:
            privileged: true
          volumeMounts:
            - name: etc-rancher-k3s
              mountPath: /etc/rancher/k3s
              readOnly: true
            - name: var-lib-rancher-k3s
              mountPath: /var/lib/rancher/k3s
              readOnly: true
            - name: var-lib-kubelet
              mountPath: /var/lib/kubelet
              readOnly: true
            - name: var-lib-cni
              mountPath: /var/lib/cni
              readOnly: true
            - name: etc-cni-netd
              mountPath: /etc/cni/net.d
              readOnly: true
      volumes:
        - name: etc-rancher-k3s
          hostPath:
            path: /etc/rancher/k3s
        - name: var-lib-rancher-k3s
          hostPath:
            path: /var/lib/rancher/k3s
        - name: var-lib-kubelet
          hostPath:
            path: /var/lib/kubelet
        - name: var-lib-cni
          hostPath:
            path: /var/lib/cni
        - name: etc-cni-netd
          hostPath:
            path: /etc/cni/net.d