From 77f66511e70c4b2c1f83988786e3de04ec7349db Mon Sep 17 00:00:00 2001 From: Nick Smith Date: Tue, 28 Jan 2020 15:45:31 +0000 Subject: [PATCH] Set all host-mounted volumes to be read-only. (#569) By setting all host-mounted volumes to be read-only we reduce the likelihood any host filesystem is modified by running kube-bench. --- job-eks.yaml | 3 +++ job-iks.yaml | 3 +++ job-master.yaml | 3 +++ job-node.yaml | 4 ++++ job.yaml | 5 +++++ 5 files changed, 18 insertions(+) diff --git a/job-eks.yaml b/job-eks.yaml index 6f82c31..b0cac98 100644 --- a/job-eks.yaml +++ b/job-eks.yaml @@ -15,10 +15,13 @@ spec: volumeMounts: - name: var-lib-kubelet mountPath: /var/lib/kubelet + readOnly: true - name: etc-systemd mountPath: /etc/systemd + readOnly: true - name: etc-kubernetes mountPath: /etc/kubernetes + readOnly: true restartPolicy: Never volumes: - name: var-lib-kubelet diff --git a/job-iks.yaml b/job-iks.yaml index 8a5fd38..3d3d072 100644 --- a/job-iks.yaml +++ b/job-iks.yaml @@ -14,10 +14,13 @@ spec: volumeMounts: - name: var-lib-kubelet mountPath: /var/lib/kubelet + readOnly: true - name: etc-systemd mountPath: /etc/systemd + readOnly: true - name: etc-kubernetes mountPath: /etc/kubernetes + readOnly: true restartPolicy: Never volumes: - name: var-lib-kubelet diff --git a/job-master.yaml b/job-master.yaml index 5896bd3..27cecb2 100644 --- a/job-master.yaml +++ b/job-master.yaml @@ -20,12 +20,15 @@ spec: volumeMounts: - name: var-lib-etcd mountPath: /var/lib/etcd + readOnly: true - name: etc-kubernetes mountPath: /etc/kubernetes + readOnly: true # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. # You can omit this mount if you specify --version as part of the command. - name: usr-bin mountPath: /usr/bin + readOnly: true restartPolicy: Never volumes: - name: var-lib-etcd diff --git a/job-node.yaml b/job-node.yaml index 0bdc2a1..b9133e9 100644 --- a/job-node.yaml +++ b/job-node.yaml @@ -14,14 +14,18 @@ spec: volumeMounts: - name: var-lib-kubelet mountPath: /var/lib/kubelet + readOnly: true - name: etc-systemd mountPath: /etc/systemd + readOnly: true - name: etc-kubernetes mountPath: /etc/kubernetes + readOnly: true # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. # You can omit this mount if you specify --version as part of the command. - name: usr-bin mountPath: /usr/bin + readOnly: true restartPolicy: Never volumes: - name: var-lib-kubelet diff --git a/job.yaml b/job.yaml index 411c164..5f09651 100644 --- a/job.yaml +++ b/job.yaml @@ -17,16 +17,21 @@ spec: volumeMounts: - name: var-lib-etcd mountPath: /var/lib/etcd + readOnly: true - name: var-lib-kubelet mountPath: /var/lib/kubelet + readOnly: true - name: etc-systemd mountPath: /etc/systemd + readOnly: true - name: etc-kubernetes mountPath: /etc/kubernetes + readOnly: true # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. # You can omit this mount if you specify --version as part of the command. - name: usr-bin mountPath: /usr/bin + readOnly: true restartPolicy: Never volumes: - name: var-lib-etcd