kube-bench: Automated CIS Kubernetes Benchmark Compliance

Introduction

In mid-2017, kube-bench emerged as the first automated tool for checking Kubernetes clusters against the CIS (Center for Internet Security) Kubernetes Benchmark. Developed by Aqua Security, kube-bench addressed a critical gap: while the CIS Benchmark provided comprehensive security guidelines, manually auditing clusters against hundreds of controls was time-consuming and error-prone.

This mattered because security compliance had become a requirement for enterprise Kubernetes adoption. Organizations needed to demonstrate that their clusters met security standards for regulatory compliance, security audits, and risk management. kube-bench made compliance checking accessible to teams without dedicated security expertise.

Historical note: The CIS Kubernetes Benchmark was first published in 2017, providing the first industry-standard security configuration guide for Kubernetes. kube-bench was created to automate compliance checking against these benchmarks.

CIS Kubernetes Benchmark Overview

What is the CIS Benchmark?

The CIS Kubernetes Benchmark is a set of security configuration guidelines developed by the Center for Internet Security. It provides:

• Control Plane Security: Hardening recommendations for API server, etcd, scheduler, and controller manager.
• Node Security: Configuration guidelines for kubelet, container runtime, and worker nodes.
• Policy Configuration: RBAC, network policies, and pod security standards.
• Authentication and Authorization: User authentication, service accounts, and access controls.

Benchmark Structure

The benchmark is organized into sections:

1. Master Node Security: API server, etcd, scheduler, controller manager configurations.
2. Worker Node Security: Kubelet configuration and container runtime security.
3. Policy Configuration: RBAC, network policies, and pod security.
4. Authentication and Authorization: Service accounts, user authentication, and access controls.

kube-bench Features

Automated Compliance Checking

• CIS Benchmark Coverage: Checks clusters against all CIS Benchmark controls.
• Multiple Kubernetes Versions: Supports different Kubernetes versions with version-specific benchmarks.
• Component-Specific Checks: Separate checks for master nodes, worker nodes, etcd, and policies.
• Remediation Guidance: Provides specific recommendations for fixing identified issues.

Installation and Usage

# Install kube-bench
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.1.0/kube-bench_0.1.0_linux_amd64.tar.gz -o kube-bench.tar.gz
tar -xzf kube-bench.tar.gz
sudo mv kube-bench /usr/local/bin/

# Run checks on master node
kube-bench master

# Run checks on worker node
kube-bench node

# Run all checks
kube-bench all

Output Format

kube-bench provides structured output:

[PASS] 1.1.1 Ensure that the API server pod specification file has permissions of 644 or more restrictive
[FAIL] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root
[WARN] 1.1.3 Ensure that the controller manager pod specification file has permissions of 644 or more restrictive

Comparison: kube-bench vs Manual Security Audits

Common Security Findings

Control Plane Issues

• Insecure API Server Configuration: API server exposed on insecure port, missing authentication.
• Weak etcd Security: etcd not configured with TLS, weak file permissions.
• Missing Audit Logging: Audit logs not configured or not retained.
• Insecure Scheduler/Controller Manager: Missing security configurations.

Node Security Issues

• Kubelet Configuration: Kubelet not configured with proper authentication and authorization.
• Container Runtime Security: Docker/containerd not configured with security best practices.
• File Permissions: Configuration files with overly permissive permissions.

Policy Configuration Issues

• RBAC Not Enabled: Cluster using ABAC or no authorization.
• Network Policies Missing: No network policies to restrict pod-to-pod communication.
• Pod Security: Pods running with excessive privileges.

Integration into CI/CD Pipelines

Jenkins Integration

stage('Security Scan') {
    steps {
        sh '''
            kube-bench --json > kube-bench-results.json
            # Parse results and fail build if critical issues found
        '''
    }
}

GitLab CI Integration

security_scan:
  stage: test
  script:
    - kube-bench --json > kube-bench-results.json
    - |
      if grep -q '"status":"FAIL"' kube-bench-results.json; then
        echo "Security compliance check failed"
        exit 1
      fi

Remediation Strategies

Automated Remediation

Some findings can be automatically remediated:

# Fix file permissions
sudo chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml
sudo chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml

# Enable RBAC
kube-apiserver --authorization-mode=RBAC

Manual Remediation

Many findings require manual review and configuration:

• API Server Configuration: Update kube-apiserver flags and configuration.
• RBAC Policies: Create roles and role bindings for proper access control.
• Network Policies: Define network policies for pod-to-pod communication.
• Audit Logging: Configure audit logging for compliance and security monitoring.

Practical Considerations

Benchmark Version Compatibility

• Kubernetes Version: Different Kubernetes versions have different benchmark versions.
• Component Versions: etcd, kubelet, and container runtime versions affect benchmark applicability.
• Update Frequency: CIS Benchmarks are updated as Kubernetes evolves.

False Positives

Some kube-bench findings may be false positives:

• Managed Services: Some checks don’t apply to managed Kubernetes services (EKS, AKS, GKE).
• Custom Configurations: Custom setups may require different security configurations.
• Context-Dependent: Some findings need context to determine if they’re actual security issues.

Compliance Reporting

kube-bench results can be used for:

• Security Audits: Demonstrate compliance with security standards.
• Regulatory Compliance: Meet requirements for HIPAA, PCI-DSS, SOC 2, etc.
• Risk Management: Identify and prioritize security risks.
• Continuous Improvement: Track security posture over time.

Getting Started

# Install kube-bench
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.1.0/kube-bench_0.1.0_linux_amd64.tar.gz -o kube-bench.tar.gz
tar -xzf kube-bench.tar.gz
sudo mv kube-bench /usr/local/bin/

# Run on master node
kube-bench master

# Run on worker node
kube-bench node

# Generate JSON report
kube-bench --json > compliance-report.json

Caveats & Lessons Learned

• Benchmark Updates: CIS Benchmarks are updated regularly; ensure you’re using the latest version.
• Version Compatibility: Different Kubernetes versions require different benchmark versions.
• Managed Services: Some checks don’t apply to managed Kubernetes services.
• Remediation Impact: Some remediations may break existing functionality; test thoroughly.

Common Failure Modes

• “False positives”: Some findings may not be actual security issues in your context.
• “Version mismatch”: Using wrong benchmark version for your Kubernetes version.
• “Managed service confusion”: Trying to apply node checks to managed control planes.

Conclusion

kube-bench’s introduction in 2017 marked a turning point in Kubernetes security compliance. It made CIS Benchmark compliance checking accessible to teams without dedicated security expertise, enabling organizations to demonstrate security compliance and identify security misconfigurations.

While kube-bench didn’t replace security expertise, it democratized compliance checking and made it part of standard operational practices. Teams could now run security compliance checks as part of their CI/CD pipelines, track security posture over time, and demonstrate compliance to auditors and regulators.

For organizations adopting Kubernetes in 2017, kube-bench became an essential tool for security compliance and risk management. It demonstrated that security didn’t have to be an afterthought—it could be automated, repeatable, and integrated into standard operational workflows.