Running kube-bench on a cluster

[ratnopamc]

Hi,

I would like to know if there's a way to run kube-bench by specifying a kubeconfig file of a target kubernetes cluster. The use case is that I need to run kube-bench on a local and remote kubernetes cluster. Instead of specifying node names (like master and node), I was wondering if we can specify the kubeconfig of the K8S cluster while running kube-bench.

[mozillazg]

@eratnch Here is the document about this case: https://github.com/aquasecurity/kube-bench#running-in-a-kubernetes-cluster

[ratnopamc]

Thanks @mozillazg , I'll check.

[ratnopamc]

The scenario is that from a jump server, K8S clusters are deployed on different cloud providers such as GCP, Azure and AWS. The jump server is where the CI tests are triggered from. If I need to trigger the kube-bench test from the jump server what would be the best approach? The jump server is in a completely different network than the target K8S clusters. However the kubeconfig of the remote K8S cluster is available on the jump server. I understand that one approach could be to ssh into the nodes, install kube-bench on the nodes and run the tests, however I prefer the job.yaml approach of running in a pod. However the question remains as to how to tell job.yaml to a run in a remote k8s cluster. Does kube-bench allow to specify kubeconfig parameter either in job.yaml or in CLI mode? Could you please advise.

[saisatishkarra]

@mozillazg I have a similar need to run kube-bench as a standalone process outside the k8s cluster by leveraging the kubeconfig file accessible to provide cluster context. The goal is NOT use /install the trivy-operator / run kube-bench as a job / pod within the cluster as k8s workload.

Q&A:

1. Is it possible (Supported / Unsupported) to run kube-bench as a standalone CLI scan targeting clusters in kubeconfig?
2. If supported, is there a list of RBAC access rules needed to achieve this?
3. If supported, How can kube-bench running as standalone target specific nodes within cluster for node CIS benchmarks as there is no way to specifying the mount paths to a standalone CLI leveraging kubeconfig?