kube-bench — CIS Kubernetes Security Benchmark

What it is

kube-bench is a Go application by Aqua Security that checks whether Kubernetes clusters are deployed according to CIS Benchmark security guidelines. It scans master and worker node configurations, verifying settings like API server flags, kubelet parameters, and etcd encryption. Results are categorized as PASS, FAIL, WARN, or INFO.

kube-bench targets cluster administrators and security teams who need automated compliance checks against the CIS Kubernetes Benchmark.

How it saves time or tokens

kube-bench automates hundreds of manual security checks that would take hours to perform by hand. Each check includes a rationale and remediation command, so you fix issues without researching each CIS control separately.

How to use

1. Run as a Kubernetes Job:

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job.batch/kube-bench

1. Or run directly on a node:

kube-bench run --targets master
kube-bench run --targets node

1. Review the PASS/FAIL/WARN output and apply remediations.

Example

# Run as Kubernetes Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

# View results
kubectl logs job.batch/kube-bench

# Run on a specific node
kube-bench run --targets master

# Output as JSON for CI integration
kube-bench run --json

# Run specific CIS section
kube-bench run --targets master --check 1.2

Related on TokRepo

• AI Tools for Security — Security scanning and compliance tools
• AI Tools for DevOps — Kubernetes and infrastructure tools

Key considerations

When evaluating kube-bench for your workflow, consider the following factors. First, assess whether your team has the technical prerequisites to adopt this tool effectively. Second, evaluate the maintenance burden against the productivity gains. Third, check community activity and documentation quality to ensure long-term viability. Integration with your existing toolchain matters more than feature count alone. Start with a small pilot project before rolling out across the organization. Monitor resource usage during the initial adoption phase to identify bottlenecks early. Document your configuration decisions so team members can onboard independently.

Common pitfalls

• kube-bench must run on cluster nodes (or with access to node configs) to check kubelet and etcd settings; running from outside the cluster provides limited results.
• Managed Kubernetes (EKS, GKE, AKS) restricts access to master node configurations; some CIS checks cannot run on managed clusters.
• WARN results are not failures but indicate checks that could not be automatically evaluated; review them manually.