kube-bench — CIS Kubernetes Security Benchmark

Introduction

kube-bench automates CIS Kubernetes Benchmark checks so you do not have to audit cluster configurations manually. It tests API server flags, kubelet settings, etcd encryption, and RBAC policies, then reports which checks pass, fail, or need manual review.

What kube-bench Does

• Runs 200+ CIS Benchmark checks against Kubernetes components
• Tests master, worker, etcd, and control plane configurations
• Reports PASS, FAIL, WARN, and INFO status for each check
• Supports CIS benchmarks for K8s 1.20 through 1.29 and managed variants
• Outputs results as text, JSON, JUnit, or ASFF for AWS Security Hub

Architecture Overview

kube-bench is a Go binary that reads YAML-defined check definitions matching each CIS Benchmark section. It inspects process flags, file permissions, and config file contents on the node where it runs. Checks are evaluated using a simple expression engine that tests expected values against actual system state.

Self-Hosting & Configuration

• Deploy as a Kubernetes Job, DaemonSet, or standalone binary on each node
• Select benchmark version automatically or pin with --benchmark flag
• Customize checks by editing YAML definitions in the cfg directory
• Integrate with CI/CD to gate deployments on security compliance
• Ship JSON output to SIEM tools or AWS Security Hub via ASFF format

Key Features

• Covers the full CIS Kubernetes Benchmark from control plane to worker nodes
• Auto-detects Kubernetes version and selects the matching benchmark
• Built-in support for managed K8s: EKS, GKE, AKS, and ACK benchmarks
• Remediation instructions included for every failing check
• Runs without cluster-admin privileges for node-level checks

Comparison with Similar Tools

• Kubescape — broader security posture scanning with NSA/MITRE frameworks
• Polaris — focuses on workload best practices, not node-level CIS checks
• Trivy — vulnerability and misconfiguration scanner, less CIS-focused
• kube-hunter — penetration testing for K8s, not compliance auditing
• Checkov — IaC scanning for Terraform/Helm, not runtime cluster checks

FAQ

Q: Can kube-bench run on managed Kubernetes like EKS? A: Yes. Use --benchmark eks-1.2.0 to run the EKS-specific CIS benchmark that accounts for AWS-managed control plane components.

Q: Does kube-bench need root access? A: Some checks inspect file permissions under /etc/kubernetes, which requires elevated privileges. Run as a privileged pod or as root on the node.

Q: How often should I run kube-bench? A: Run it after cluster upgrades, configuration changes, and as a periodic compliance check in CI/CD pipelines.

Q: Can I exclude specific checks? A: Yes. Use the --check flag to run specific sections or edit the YAML definitions to skip checks that do not apply to your environment.

Sources

• https://github.com/aquasecurity/kube-bench
• https://aquasecurity.github.io/kube-bench/