apiVersion: v1
kind: Pod
metadata:
  name: kube-bench
  labels:
    app: kube-bench
    EksGatekeeper: ignore
spec:
  hostPID: true
  containers:
  - name: kube-bench
    image: aquasec/kube-bench:latest
    command: ["kube-bench", "node", "--benchmark", "eks-1.0"]
    volumeMounts:
      - name: var-lib-kubelet
        mountPath: /var/lib/kubelet
        readOnly: true
      - name: etc-systemd
        mountPath: /etc/systemd
        readOnly: true
      - name: etc-kubernetes
        mountPath: /etc/kubernetes
        readOnly: true
    securityContext:
      privileged: true
  restartPolicy: Never
  volumes:
    - name: var-lib-kubelet
      hostPath:
        path: "/var/lib/kubelet"
    - name: etc-systemd
      hostPath:
        path: "/etc/systemd"
    - name: etc-kubernetes
      hostPath:
        path: "/etc/kubernetes"
