Labels are ignored when kubeaudit is run inside a cluster #568
Description
ISSUE TYPE
- Bug Report
- Feature Idea
BUG REPORT
SUMMARY
When running kubeaudit locally, I get no output (succeeded)
When running inside the cluster I get:
2023-08-04T02:52:01.843817745Z {"AuditResultName":"ReadOnlyRootFilesystemNil","Container":"aws-cli-associate-eip","ResourceApiVersion":"apps/v1","ResourceKind":"Deployment","ResourceName":"<PodName>","ResourceNamespace":"<namespace>","level":"error","msg":"readOnlyRootFilesystem is not set in container SecurityContext. It should be set to 'true'.","time":"2023-08-04T02:52:01Z"}
The pod has these labels:
spec:
template:
metadata:
labels:
container.kubeaudit.io/aws-cli-associate-eip.allow-read-only-root-filesystem-false: "RequiredForVPN"
I can confirm the label is working properly because removing it from the deployment causes the local kubeaudit to fail.
Cluster kubeaudit command:
kubeaudit all -m Warning -k ../tmp/kubeauditconfig.yaml --format json --exitcode 0
Local kubeaudit command:
kubeaudit all -m Warning -k kubeauditconfig.yaml --context <context> --format json --exitcode 0
both kubeaudit config files are identical.
The job inside the cluster is deployed with the "With RBAC" config as outlined here:
https://github.com/Shopify/kubeaudit/blob/main/docs/cluster.md#with-rbac
It may be worth noting that all of the pods that have their labels ignored are using host networking and live outside the normal subnets for the other pods. I'm unsure if this makes a difference because from what I understand this should only be querying the kubernetes API.
ENVIRONMENT
kubeaudit 0.22.0
kubernetes EKS 1.27.3
Activity