github/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2026-02-14 10:00:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set all host-mounted volumes to be read-only. (#569)

Browse Source 
By setting all host-mounted volumes to be read-only we reduce the likelihood
any host filesystem is modified by running kube-bench.
This commit is contained in:
Nick Smith
2020-01-28 15:45:31 +00:00
committed by Roberto Rojas
parent 037bb14729
commit 77f66511e7
5 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
job-iks.yaml
View File

@@ -14,10 +14,13 @@ spec:
volumeMounts:
- name: var-lib-kubelet
mountPath: /var/lib/kubelet
readOnly: true
- name: etc-systemd
mountPath: /etc/systemd
readOnly: true
- name: etc-kubernetes
mountPath: /etc/kubernetes
readOnly: true
restartPolicy: Never
volumes:
- name: var-lib-kubelet