benchmarking-kubernetes-with-kube-bench

name	benchmarking-kubernetes-with-kube-bench
description	Run kube-bench (Aqua Security) against a Kubernetes cluster's control-plane, kubelet, and node configuration to check compliance with the CIS Kubernetes Benchmark and remediate PASS/FAIL/WARN findings. Use when establishing a security baseline for a new cluster, performing periodic hardening audits, validating remediation after configuration changes, or gathering compliance evidence for SOC 2/PCI DSS.
domain	cybersecurity
subdomain	container-security
tags	["kubernetes","kube-bench","cis-benchmark","container-security","hardening","compliance","cluster-security"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01"]
mitre_attack	["T1610"]

Benchmarking Kubernetes with kube-bench

Overview

kube-bench (by Aqua Security) is an open-source tool that checks whether a Kubernetes cluster is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. It inspects the control-plane components (API server, controller manager, scheduler, etcd), the kubelet and worker-node configuration, and cluster-wide policy settings, then reports each check as PASS, FAIL, WARN, or INFO with a remediation recommendation drawn directly from the CIS guidance. Tests are configuration-driven YAML files, so kube-bench tracks new Kubernetes versions and benchmark revisions and supports managed distributions (EKS, GKE, AKS, ACK, OpenShift, RKE, k3s).

Hardening a cluster against the CIS Benchmark directly reduces the attack surface for T1610 (Deploy Container), where an adversary deploys a container to execute code or evade defenses — for example by abusing privileged containers, host namespaces, anonymous API access, or insecure kubelet settings that an unhardened cluster leaves exposed.

kube-bench can run as a standalone binary on a node, inside a container, or — most commonly — as a Kubernetes Job whose pod has the host filesystem mounted so it can read the relevant config files. Output is available as human-readable text, JSON, JUnit, or AWS Security Finding Format (ASFF) and can be pushed to a PostgreSQL database for trend tracking.

When to Use

• When establishing a security baseline for a new Kubernetes cluster against the CIS Kubernetes Benchmark.
• When performing periodic compliance audits of control-plane and node hardening.
• When validating remediation after applying hardening changes (re-run to confirm checks now PASS).
• When integrating cluster compliance scanning into CI/CD or a continuous monitoring pipeline.
• When preparing evidence for SOC 2, PCI DSS, or internal hardening compliance.

Prerequisites

• Access to the cluster: either SSH access to a control-plane/worker node (binary mode) or kubectl with permission to create Jobs (in-cluster mode).
• Knowledge of the cluster's Kubernetes version (kube-bench auto-detects, or specify with --version / --benchmark).
• Install kube-bench (Aqua Security official methods):

# Binary release (Linux)
KB_VERSION=0.10.7
curl -L -o kube-bench.tgz \
  "https://github.com/aquasecurity/kube-bench/releases/download/v${KB_VERSION}/kube-bench_${KB_VERSION}_linux_amd64.tar.gz"
tar -xzf kube-bench.tgz
sudo  kube-bench /usr/local/bin/
  -R cfg /etc/kube-bench/cfg


go install github.com/aquasecurity/kube-bench@latest


docker run -- --pid=host \
  -v /etc:/etc:ro -v /var:/var:ro \
  -t docker.io/aquasec/kube-bench:latest run --targets node


kube-bench version