---

apiVersion: batch/v1

kind: Job

metadata:

name: kube-bench

spec:

template:

spec:

hostPID: true

containers:

- name: kube-bench

# Push the image to your ECR and then refer to it here

# image: <ID.dkr.ecr.region.amazonaws.com/aquasec/kube-bench:ref>

image: aquasec/kube-bench:latest

# To send findings to AWS Security Hub, refer to `job-eks-asff.yaml` instead

command: ["kube-bench", "run", "--targets", "node", "--benchmark", "eks-1.0"]

volumeMounts:

- name: var-lib-kubelet

mountPath: /var/lib/kubelet

readOnly: true

- name: etc-systemd

mountPath: /etc/systemd

readOnly: true

- name: etc-kubernetes

mountPath: /etc/kubernetes

readOnly: true

restartPolicy: Never

volumes:

- name: var-lib-kubelet

hostPath:

path: "/var/lib/kubelet"

- name: etc-systemd

hostPath:

path: "/etc/systemd"

- name: etc-kubernetes

hostPath:

path: "/etc/kubernetes"