apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench-master
spec:
  template:
    spec:
      hostPID: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      containers:
      - name: kube-bench
        image: aquasec/kube-bench:latest
        # Checks available: https://github.com/aquasecurity/kube-bench/blob/master/cfg/1.11/master.yaml
        command: ["kube-bench","master", "--version", "1.11", "--check=1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.1.7,1.1.8,1.1.9,1.1.10,1.1.11,1.1.12,1.1.13,1.1.14,1.1.15,1.1.16,1.1.17,1.1.18,1.1.19,1.1.20,1.1.21,1.1.22,1.1.23,1.1.24,1.1.25,1.1.26,1.1.27,1.1.28,1.1.29,1.1.30,1.1.31,1.1.32,1.1.33,1.1.34,1.1.35,1.1.36,1.1.37,1.1.38,1.1.39,1.2.1,1.2.2,1.3.1,1.3.2,1.3.3,1.3.4,1.3.5,1.3.6,1.3.7,1.4.1,1.4.2,1.4.3,1.4.4,1.4.5,1.4.6,1.4.7,1.4.8,1.4.9,1.4.10,1.4.13,1.4.14,1.4.15,1.4.16,1.4.17,1.4.18,1.5.1,1.5.2,1.5.3,1.5.4,1.5.5,1.5.6,1.5.7,1.6.1,1.6.2,1.6.3,1.6.4,1.6.5,1.6.6,1.6.7,1.6.8,1.7.1,1.7.2,1.7.3,1.7.4,1.7.5,1.7.6,1.7.7"]
        # command: ["sleep", "999999"]
        volumeMounts:
        - name: var-lib-etcd
          mountPath: /var/lib/etcd
        - name: etc-kubernetes
          mountPath: /etc/kubernetes
          # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
          # You can omit this mount if you specify --version as part of the command.
        - name: usr-bin
          mountPath: /usr/bin
      restartPolicy: Never
      volumes:
      - name: var-lib-etcd
        hostPath:
          path: "/var/lib/etcd"
      - name: etc-kubernetes
        hostPath:
          path: "/etc/kubernetes"
      # CoreOS path to where the kubelet binary is
      - name: usr-bin
        hostPath:
          path: "/opt/kubernetes/bin"
      nodeSelector:
        kubernetes.io/role: master
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
