performing-kubernetes-cis-benchmark-with-kube-bench

name	performing-kubernetes-cis-benchmark-with-kube-bench
description	Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.
domain	cybersecurity
subdomain	container-security
tags	["kube-bench","cis-benchmark","kubernetes","compliance","hardening","aquasecurity"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
mitre_attack	["T1610","T1611","T1609","T1525"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d

Performing Kubernetes CIS Benchmark with kube-bench

Overview

kube-bench is an open-source Go tool by Aqua Security that runs the CIS Kubernetes Benchmark checks. It verifies control plane, etcd, worker node, and policy configurations against security best practices, producing actionable pass/fail/warn reports.

When to Use

• When conducting security assessments that involve performing kubernetes cis benchmark with kube bench
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Kubernetes cluster (v1.24+)
• kubectl with cluster-admin access
• Node access for direct runs or privileged pod access

Installation

# Binary installation
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.7.3/kube-bench_0.7.3_linux_amd64.tar.gz | tar xz
sudo mv kube-bench /usr/local/bin/

# Run as Kubernetes Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

# Run as a pod with host access
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-master.yaml
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-node.yaml

Running Benchmarks

Full Benchmark

# Run all checks (auto-detects node type)
kube-bench run

# Run with JSON output
kube-bench run --json > kube-bench-results.json

# Run with JUnit output for CI
kube-bench run --junit > kube-bench-results.xml

Component-Specific Checks

# Control plane (master) checks
kube-bench run --targets master

# Worker node checks
kube-bench run --targets node

# etcd checks
kube-bench run --targets etcd

# Policies checks
kube-bench run --targets policies

# Control plane + etcd
kube-bench run --targets master,etcd

Managed Kubernetes

# Amazon EKS
kube-bench run --benchmark eks-1.2.0


kube-bench run --benchmark gke-1.4.0


kube-bench run --benchmark aks-1.0


kube-bench run --benchmark rh-1.0