kube-bench-plugin.yaml

podSpec:
  containers: []
  dnsPolicy: ClusterFirstWithHostNet
  hostIPC: true
  hostNetwork: true
  hostPID: true
  serviceAccountName: sonobuoy-serviceaccount
  tolerations:
  - operator: Exists
  volumes:
  - name: var-lib-etcd
    hostPath:
      path: "/var/lib/etcd"
  - name: var-lib-kubelet
    hostPath:
      path: "/var/lib/kubelet"
  - name: etc-systemd
    hostPath:
      path: "/etc/systemd"
  - name: etc-kubernetes
    hostPath:
      path: "/etc/kubernetes"
  affinity:
    nodeAffinity: 
      requiredDuringSchedulingIgnoredDuringExecution: 
        nodeSelectorTerms:
        - matchExpressions:
          - key: node-role.kubernetes.io/master
            operator: DoesNotExist
sonobuoy-config:
  driver: DaemonSet
  plugin-name: kube-bench-node
  result-format: junit
spec:
  command:
  - /bin/sh
  args:
  - -c
  - kube-bench node --version 1.15 --outputfile /tmp/results/output.xml --junit ; echo -n /tmp/results/output.xml > /tmp/results/done
  image: aquasec/kube-bench:0.2.2
  name: plugin
  resources: {}
  volumeMounts:
  - mountPath: /tmp/results
    name: results
  - name: var-lib-etcd
    mountPath: /var/lib/etcd
  - name: var-lib-kubelet
    mountPath: /var/lib/kubelet
  - name: etc-systemd
    mountPath: /etc/systemd
  - name: etc-kubernetes
    mountPath: /etc/kubernetes