What is kube-bench?

kube-bench is an open-source tool that checks whether your Kubernetes cluster is secure, based on the CIS (Center for Internet Security) Benchmarks.

It audits your cluster against industry best practices and reports misconfigurations or insecure settings.

Simple Explanation (Layman Terms)

Imagine kube-bench like a security checklist app for your Kubernetes cluster:

• Is your API server using encryption?
• Are your kubelets secure?
• Are permissions set correctly?

kube-bench checks all this — and tells you what’s good and what’s risky.

CIS Benchmarks

The CIS Kubernetes Benchmark is a list of security controls and hardening steps. kube-bench runs these checks on:

• Control plane (API server, etcd, scheduler, controller-manager)
• Worker nodes (kubelet)
• Configuration files (like kube-apiserver.yaml, kubelet.conf, etc.)

How to Use kube-bench

Download

curl -L https://github.com/aquasecurity/kube-bench/releases/latest/download/kube-bench_amd64.tar.gz | tar xz

Run as root

sudo ./kube-bench

Option 2: Run in a Pod (works with AKS, EKS, GKE, etc.)

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

This creates a Kubernetes Job that runs kube-bench once on the node.

Use with Helm

Install kube-bench with Helm if you’re managing it in GitOps or want flexibility:

Example Output

== Running kube-bench for node ==
[PASS] 1.1.1 Ensure that the –anonymous-auth argument is set to false
[FAIL] 1.1.2 Ensure that the –authorization-mode argument is not set to AlwaysAllow
[WARN] 1.1.3 Ensure that the –client-ca-file argument is set as appropriate

It shows:

• ✅ PASS: Compliant
• ❌ FAIL: Not compliant
• ⚠️ WARN: Might be a risk

Best Practices

• Run kube-bench after every major upgrade
• Automate it as part of a weekly scan job
• Combine with tools like Kyverno and Trivy for full security coverage

Combine with Kyverno (Bonus Tip)

You can use kube-bench findings to create Kyverno policies that prevent future misconfigurations.

Example: If kube-bench warns about no CPU limits, use Kyverno to block any pod that doesn’t set limits.