kube-bench

kube-bench run --targets master

Audit the Kubernetes cluster against the CIS Benchmark with kube-bench, detecting insecure control plane and node configurations.

Run it on the cluster (or in the infrastructure pipeline) when you want the audit against the Kubernetes CIS Benchmark: kube-bench evaluates the components (API server, etcd, kubelet, nodes) against the benchmark controls and reports findings — insecure configurations (anonymous auth, etcd encryption, file permissions) with the result (PASS/FAIL/WARN). It is the reference CIS audit for Kubernetes. In K8s DevSecOps, kube-bench is the cluster check: failed control plane controls are fixed before (or at) production rollout.

Do not use it as a full cluster analysis: kube-bench covers configuration against CIS — runtime security (pods, policies) is covered by other tools (Falco, OPA, 046/047 from batch 21... kube-hunter for attack, 038). The CIS benchmark is generic: controls that do not apply to the environment (managed services where the control plane is vendor-managed) are excluded. And note: kube-bench must run with adequate permissions (cluster access and component files) — in managed services, the master scope does not apply. Findings are triaged with cluster context.