Labels are ignored when kubeaudit is run inside a cluster

[joesteffee]

ISSUE TYPE

• [x] Bug Report
• [ ] Feature Idea

BUG REPORT

SUMMARY

When running kubeaudit locally, I get no output (succeeded) When running inside the cluster I get:

2023-08-04T02:52:01.843817745Z {"AuditResultName":"ReadOnlyRootFilesystemNil","Container":"aws-cli-associate-eip","ResourceApiVersion":"apps/v1","ResourceKind":"Deployment","ResourceName":"<PodName>","ResourceNamespace":"<namespace>","level":"error","msg":"readOnlyRootFilesystem is not set in container SecurityContext. It should be set to 'true'.","time":"2023-08-04T02:52:01Z"}  

The pod has these labels:

spec:
  template:
    metadata:
      labels:
        container.kubeaudit.io/aws-cli-associate-eip.allow-read-only-root-filesystem-false: "RequiredForVPN"

I can confirm the label is working properly because removing it from the deployment causes the local kubeaudit to fail.

Cluster kubeaudit command:

kubeaudit all -m Warning -k ../tmp/kubeauditconfig.yaml --format json --exitcode 0

Local kubeaudit command:

kubeaudit all -m Warning -k kubeauditconfig.yaml --context <context> --format json --exitcode 0

both kubeaudit config files are identical.

The job inside the cluster is deployed with the "With RBAC" config as outlined here: https://github.com/Shopify/kubeaudit/blob/main/docs/cluster.md#with-rbac

It may be worth noting that all of the pods that have their labels ignored are using host networking and live outside the normal subnets for the other pods. I'm unsure if this makes a difference because from what I understand this should only be querying the kubernetes API.

ENVIRONMENT

kubeaudit 0.22.0 kubernetes EKS 1.27.3

[github-actions[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template!

[ClaaudiaGarcia]

I have the same problem. Is there any news on how to fix it?