Update kubebench pack to 0.16.0

[svalenciah19]

Update kubebench pack to 0.16.0

[vishwanaths]

Pack review — cks-kubebench-0.16.0

Packs Validation: ❌ FAILURE (run https://github.com/spectrocloud/pack-central/actions/runs/32532939874/job/96928427616) — individual errors listed under Blockers below
source annotation: ✅ community
Pack metadata: name=kubebench version=0.16.0 addonType=security layer=addon displayName=Kubebench contributor=spectrocloud

Compared against packs/cks-kubebench-0.16.7/

Note: the previous version on main (0.16.7) is higher than the version this PR adds (0.16.0). See the version-downgrade blocker below.

Summary of differences

• pack.json: only version changed — bumped down from 0.16.7 to 0.16.0. All other fields (name, addonType, layer, displayName, cloudTypes, annotations, kubeManifests) are unchanged.
• values.yaml: previously empty (0 bytes); now defines pack.namespace: "kube-bench". No images: block is present — this is what the validator is failing on.
• manifests/job.yaml: reformatted to a different YAML style (key ordering, indentation), functionally re-adds hostPID: true and all the same host mounts, plus adds a new var-lib-cni volume + mount at /var/lib/cni. The container image bumped from aquasec/kube-bench:v0.6.7 → docker.io/aquasec/kube-bench:v0.16.0 (note the registry prefix was added and the tag jumped several minor versions).
• README.md: new file (106 lines) — adds prerequisites, parameters table, upgrade/usage/validation sections, references. Nice addition.
• logo.png: unchanged (identical size, 87909 bytes).
• No chart tarballs in either version (this is a kubeManifests-only pack).

pack.json diff

--- a/pack.json
+++ b/pack.json
@@ -13,5 +13,5 @@
     "displayName": "Kubebench",
     "layer":"addon",
     "name": "kubebench",
-    "version": "0.16.7"
+    "version": "0.16.0"
   }

values.yaml diff

--- a/values.yaml
+++ b/values.yaml
@@ -0,0 +1,2 @@
+pack:
+  namespace: "kube-bench"

manifests/job.yaml diff (truncated — see files tab for full)

-      hostPID: true
       containers:
-        - name: kube-bench
-          image: aquasec/kube-bench:v0.6.7
-          command: ["kube-bench"]
-          volumeMounts:
-            - name: var-lib-etcd
-              mountPath: /var/lib/etcd
-              readOnly: true
+      - command: [ "kube-bench" ]
+        image: docker.io/aquasec/kube-bench:v0.16.0
+        name: kube-bench
+        volumeMounts:
+        - name: var-lib-cni
+          mountPath: /var/lib/cni
+          readOnly: true
+        - mountPath: /var/lib/etcd
+          name: var-lib-etcd
+          readOnly: true
... (reformatted volumeMounts / volumes lists follow; hostPID: true is preserved further down)
+      hostPID: true

Blockers

• Version downgrade: PR adds cks-kubebench-0.16.0 but main already has cks-kubebench-0.16.7 — confirm this is an intentional back-port, not a mistake. If the intent was to track the upstream aquasec/kube-bench:v0.16.0 image tag, the pack version still needs to be strictly greater than 0.16.7 (e.g. 0.17.0) to avoid a semver regression in Palette.
• Packs Validation: Image content verification failed for packs/cks-kubebench-0.16.0. Make sure you have image: array defined under images: section of values.yaml
• Packs Validation: Image sources size is 0. Include the images used in the pack in packs/cks-kubebench-0.16.0/values.yaml — add an images: list under a top-level images: key in values.yaml referencing docker.io/aquasec/kube-bench:v0.16.0 so image scanning / mirroring works.
• Packs Validation: Packs validation failed... (aggregate failure line from the workflow — resolved once the two errors above are fixed).

Nits / observations

• New var-lib-cni hostPath mount is a genuine functional addition — worth calling out in the PR description so reviewers know it isn't purely a reformat.
• YAML style in manifests/job.yaml was rewritten (key order, list indentation). The functional content is preserved, but the churn makes the diff noisy; consider keeping the previous style if the rewrite wasn't deliberate.
• Container image now uses the fully-qualified docker.io/aquasec/kube-bench:... reference (previously implicit). Good for clarity, but pair it with an explicit images: entry in values.yaml (also required to unblock validation).
• pack.json still has no trailing newline; unrelated to this PR but easy to fix while you're editing the file.
• Container image tag v0.16.0 inside job.yaml happens to equal the pack version — coincidence, or is the pack version now meant to track the upstream image tag? If yes, please document that convention in the PR description and pick a pack version that is still > 0.16.7.

Review generated by the pack-reviewer Claude Code subagent.