The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed according to security best practices.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
Go to file
dependabot[bot] a225f497c5
build(deps): bump k8s.io/apimachinery from 0.29.3 to 0.30.2
5 days ago
.github Replace custom k3s etcd script checks with vanilla grep checks (#1601) 1 month ago
cfg Replace custom k3s etcd script checks with vanilla grep checks (#1601) 1 month ago
check chore: remove refs to deprecated io/ioutil (#1504) 7 months ago
cmd chore: remove refs to deprecated io/ioutil (#1504) 7 months ago
docs support CIS Kubernetes Benchmark v1.8.0 (#1527) 7 months ago
hack Adding eks-stig-kubernetes-v1r6 (#1266) 2 years ago
hooks adds kube-bench version to docker build hook (#524) 5 years ago
integration/testdata fix wrong use of flag in test_items found in 4.13 and 4.14 (#1528) 7 months ago
internal/findings Migrate to aws-sdk-go-v2 (#1268) 2 years ago
.gitignore release: prepare v0.6.7-rc1 (#1136) 2 years ago
.golangci.yaml chore(lint): setup golangci-lint (#1144) 2 years ago
.goreleaser.yml Statically link binaries and remove debug information (#1615) 1 month ago
.yamllint.yaml Support Linting YAML as part of Travis CI build (#554) 5 years ago
CONTRIBUTING.md Adding eks-stig-kubernetes-v1r6 (#1266) 2 years ago
Dockerfile build(deps): bump alpine from 3.19.1 to 3.20.0 (#1621) 3 weeks ago
Dockerfile.fips.ubi build(deps): bump golang from 1.22.1 to 1.22.2 (#1596) 2 months ago
Dockerfile.ubi build(deps): bump golang from 1.22.1 to 1.22.2 (#1596) 2 months ago
LICENSE Initial commit 7 years ago
NOTICE Create NOTICE (#199) 6 years ago
OWNERS Create OWNERS 7 years ago
README.md updates to the readme 9 months ago
codecov.yml Improve Proxykubeconfig tests (#708) 4 years ago
entrypoint.sh Set -e to fail fast 6 years ago
fipsonly.go chore: add fips compliant images (#1473) 11 months ago
go.mod build(deps): bump k8s.io/apimachinery from 0.29.3 to 0.30.2 5 days ago
go.sum build(deps): bump k8s.io/apimachinery from 0.29.3 to 0.30.2 5 days ago
job-ack.yaml fix: fully qualified image names (#1206) 2 years ago
job-aks.yaml fix: fully qualified image names (#1206) 2 years ago
job-eks-asff.yaml support CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.2.0 (#1449) 1 year ago
job-eks-stig.yaml Adding eks-stig-kubernetes-v1r6 (#1266) 2 years ago
job-eks.yaml support CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.2.0 (#1449) 1 year ago
job-gke.yaml fix: fully qualified image names (#1206) 2 years ago
job-iks.yaml fix: fully qualified image names (#1206) 2 years ago
job-master.yaml job.yaml: Adding /var/lib/cni mounts for proper CIS 1.1.9 and 1.1.0 checking (#1547) 4 months ago
job-node.yaml job.yaml: Adding /var/lib/cni mounts for proper CIS 1.1.9 and 1.1.0 checking (#1547) 4 months ago
job-tkgi.yaml add support VMware Tanzu(TKGI) Benchmarks v1.2.53 (#1452) 1 year ago
job.yaml release: prepare-v0.7.3 (#1599) 2 months ago
main.go Fix issue #16 about supporting verbosity. 7 years ago
makefile chore: add fips compliant images (#1473) 11 months ago
mkdocs.yml Fixing typos (#899) 3 years ago

README.md

GitHub Release Downloads Docker Pulls Go Report Card Build Status License Coverage Status

kube-bench logo

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Tests are configured with YAML files, making this tool easy to update as test specifications evolve.

Kubernetes Bench for Security

CIS Scanning as part of Trivy and the Trivy Operator

Trivy, the all in one cloud native security scanner, can be deployed as a Kubernetes Operator inside a cluster. Both, the Trivy CLI, and the Trivy Operator support CIS Kubernetes Benchmark scanning among several other features.

Quick start

There are multiple ways to run kube-bench. You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.

The supplied job.yaml file can be applied to run the tests as a job. For example:

$ kubectl apply -f job.yaml
job.batch/kube-bench created

$ kubectl get pods
NAME                      READY   STATUS              RESTARTS   AGE
kube-bench-j76s9   0/1     ContainerCreating   0          3s

# Wait for a few seconds for the job to complete
$ kubectl get pods
NAME                      READY   STATUS      RESTARTS   AGE
kube-bench-j76s9   0/1     Completed   0          11s

# The results are held in the pod's logs
kubectl logs kube-bench-j76s9
[INFO] 1 Master Node Security Configuration
[INFO] 1.1 API Server
...

For more information and different ways to run kube-bench see documentation

Please Note

  1. kube-bench implements the CIS Kubernetes Benchmark as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the CIS community.

  2. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See CIS Kubernetes Benchmark support to see which releases of Kubernetes are covered by different releases of the benchmark.

By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.

Contributing

Kindly read Contributing before contributing. We welcome PRs and issue reports.

Roadmap

Going forward we plan to release updates to kube-bench to add support for new releases of the CIS Benchmark. Note that these are not released as frequently as Kubernetes releases.