diff --git a/README.md b/README.md index 8044422..f683277 100644 --- a/README.md +++ b/README.md @@ -19,10 +19,31 @@ kube-bench supports the tests for multiple versions of Kubernetes (1.6, 1.7 and You can either install kube-bench through a dedicated container, or compile it from source: -1. Container installation: -Run ```docker run --rm -v `pwd`:/host aquasec/kube-bench:latest```. This will copy the kube-bench binary and configuration to you host. You can then run ```./kube-bench ```. +### Running inside a container + +You can avoid installing kube-bench entirely by running it inside a container using the host PID namespace. + +``` +docker run --pid=host aquasec/kube-bench:latest +``` + +You can even use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/` + +``` +docker run --pid=host -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yaml aquasec/kube-bench:latest +``` + +### Installing from a container + +If you want to install a pre-built kube-bench, you can copy the kube-bench binary and configuration files to your host from the Docker container: +``` +docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install +``` + +You can then run `./kube-bench `. + +### Installing from sources -2. Install from sources: If Go is installed on the target machines, you can simply clone this repository and run as follows (assuming your [$GOPATH is set](https://github.com/golang/go/wiki/GOPATH)): ```go get github.com/aquasecurity/kube-bench diff --git a/entrypoint.sh b/entrypoint.sh index ad28fbf..43420e0 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,14 +1,19 @@ #!/bin/sh -if [ -d /host ]; then - mkdir -p /host/cfg/ - yes | cp -rf /cfg/* /host/cfg/ - yes | cp -rf /kube-bench /host/ - echo "===============================================" - echo "kube-bench is now installed on your host " - echo "Run ./kube-bench to perform a security check " - echo "===============================================" +if [ "$1" == "install" ]; then + if [ -d /host ]; then + mkdir -p /host/cfg/ + yes | cp -rf /cfg/* /host/cfg/ + yes | cp -rf /kube-bench /host/ + echo "===============================================" + echo "kube-bench is now installed on your host " + echo "Run ./kube-bench to perform a security check " + echo "===============================================" + else + echo "Usage:" + echo " install: docker run --rm -v \`pwd\`:/host aquasec/kube-bench install" + echo " run: docker run --rm --pid=host aquasec/kube-bench [command]" + exit + fi else - echo "Usage:" - echo " docker run --rm -v \`pwd\`:/host aquasec/kube-bench" - exit + exec kube-bench "$@" fi