---
apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench
spec:
  template:
    spec:
      hostPID: true
      containers:
        - name: kube-bench
          # Push the image to your ECR and then refer to it here
          # image: <ID.dkr.ecr.region.amazonaws.com/aquasec/kube-bench:ref>
          image: docker.io/aquasec/kube-bench:latest
          # To send findings to AWS Security Hub, refer to `job-eks-asff.yaml` instead
          command:
            [
              "kube-bench",
              "run",
              "--benchmark",
              "eks-stig-kubernetes-v1r6",
            ]
          volumeMounts:
            - name: var-lib-kubelet
              mountPath: /var/lib/kubelet
              readOnly: true
            - name: etc-systemd
              mountPath: /etc/systemd
              readOnly: true
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
              readOnly: true
      restartPolicy: Never
      volumes:
        - name: var-lib-kubelet
          hostPath:
            path: "/var/lib/kubelet"
        - name: etc-systemd
          hostPath:
            path: "/etc/systemd"
        - name: etc-kubernetes
          hostPath:
            path: "/etc/kubernetes"