kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.
Tests are configured with YAML files, making this tool easy to update as test specifications evolve.
Please Note
- kube-bench implements the CIS Kubernetes Benchmark as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the CIS community.
- There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See CIS Kubernetes Benchmark support to see which releases of Kubernetes are covered by different releases of the benchmark.
- It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.
Table of Contents
- CIS Kubernetes Benchmark support
- Installation
- Running kube-bench
- Running on OpenShift
- Output
- Configuration
- Test config YAML representation
- Roadmap
- Testing locally with kind
- Contributing
CIS Kubernetes Benchmark support
kube-bench supports the tests for Kubernetes as defined in the CIS Kubernetes Benchmarks.
| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
|---|---|---|
| 1.3.0 | cis-1.3 | 1.11-1.12 |
| 1.4.1 | cis-1.4 | 1.13-1.14 |
| 1.5.0 | cis-1.5 | 1.15- |
| GKE 1.0.0 | gke-1.0 | GKE |
| Red Hat OpenShift hardening guide | rh-0.7 | OCP 3.10-3.11 |
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine, but please note that kube-bench does not automatically detect OpenShift and GKE - see the section below on Running kube-bench.
Installation
You can choose to
- run kube-bench from inside a container (sharing PID namespace with the host)
- run a container that installs kube-bench on the host, and then run kube-bench directly on the host
- install the latest binaries from the Releases page,
- compile it from source.
Running kube-bench
If you run kube-bench directly from the command line you may need to be root / sudo to have access to all the config files.
kube-bench automatically selects which controls to use based on the detected node type and the version of Kubernetes a cluster is running. This behavior can be overridden by specifying the master or node subcommand and the --version flag on the command line.
The Kubernetes version can also be set with the KUBE_BENCH_VERSION environment variable. The value of --version takes precedence over the value of KUBE_BENCH_VERSION .
For example, run kube-bench against a master with version auto-detection:
GitHub:
Continue there…
!