Reason for Mounting mountPath: /var/lib/kubelet and Having hostPID: true

[secmesh]

What are the exact reasons for "mountPath: /var/lib/kubelet" and having HostPID set to true? Both are not ideal from a security standpoint, but are required for the tool. So reasoning for this would be helpful. (This is for job-eks.yaml)

[lizrice]

Hi @ramesh-ramani, thanks for your question

• /var/lib/kubelet is mounted so that kube-bench can read the kubelet configuration files on the host

• HostPID is needed so that kube-bench can run ps commands to observe what's running on the host and check for parameters that might override the configuration settings

[secmesh]

@lizrice thanks for that; however, in EKS, in that path (/var/lib/kubelet), there's also the kubeconfig file which has elevated rights to the cluster. So that's seems like a fairly risky mount. Is there an alternative or this is a "must-have"?