mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-12-19 05:08:07 +00:00
0d1bd2bbd9
* Delete README.md * Edit readme and separate into different files * Update README.md * Update Running.md * Update CONTRIBUTING.md * Create Contributing.md * Add files via upload * Update Index.md * Rename Flags and Commands.md to Flags_and_commands.md * Rename Index.md to index.md * Create mkdocs.yml * Delete images directory * Update README.md * Update README.md * Update README.md * Update README.md * Update README.md * Update README.md * Create mkdocs-dev.yaml * Create mkdocs-latest.yaml * Update mkdocs.yml * Update mkdocs.yml * Update mkdocs.yml Add yamllint --- * Make it yamllint comply * Make Yamllint comply * Make Yamllint comply * Change description Co-authored-by: Itay Shakury <itay@itaysk.com> * Fix syntax Co-authored-by: Itay Shakury <itay@itaysk.com> * Update docs/Architecture.md Co-authored-by: Itay Shakury <itay@itaysk.com> * Update docs/Architecture.md Co-authored-by: Itay Shakury <itay@itaysk.com> * Update example for test files * Update contributing * Delete Contributing.md * Update Flags_and_commands.md * Change syntax and add source * Update Platforms.md * lower case file names * lower case file names * Lower case file names * Lower case file names * Lower case file names * Lower case file names * Add note about inspect master in some platforms * Add quick start * Lower case files names * Lower case files names * Fixing typo * Remove section about old ocp * Fix typos Co-authored-by: Itay Shakury <itay@itaysk.com>
73 lines
4.1 KiB
Markdown
73 lines
4.1 KiB
Markdown
[![GitHub Release][release-img]][release]
|
|
![Downloads][download]
|
|
![Docker Pulls][docker-pull]
|
|
[![Go Report Card][report-card-img]][report-card]
|
|
[](https://github.com/aquasecurity/kube-bench/actions)
|
|
[](https://github.com/aquasecurity/kube-bench/blob/main/LICENSE)
|
|
[](https://microbadger.com/images/aquasec/kube-bench "Get your own image badge on microbadger.com")
|
|
[](https://microbadger.com/images/aquasec/kube-bench)
|
|
[![Coverage Status][cov-img]][cov]
|
|
|
|
[download]: https://img.shields.io/github/downloads/aquasecurity/kube-bench/total?logo=github
|
|
[release-img]: https://img.shields.io/github/release/aquasecurity/kube-bench.svg?logo=github
|
|
[release]: https://github.com/aquasecurity/kube-bench/releases
|
|
[docker-pull]: https://img.shields.io/docker/pulls/aquasec/kube-bench?logo=docker&label=docker%20pulls%20%2F%20kube-bench
|
|
[cov-img]: https://codecov.io/github/aquasecurity/kube-bench/branch/main/graph/badge.svg
|
|
[cov]: https://codecov.io/github/aquasecurity/kube-bench
|
|
[report-card-img]: https://goreportcard.com/badge/github.com/aquasecurity/kube-bench
|
|
[report-card]: https://goreportcard.com/report/github.com/aquasecurity/kube-bench
|
|
|
|
<img src="docs/images/kube-bench.png" width="200" alt="kube-bench logo">
|
|
|
|
kube-bench is tool that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
|
|
|
|
Tests are configured with YAML files, making this tool easy to update as test specifications evolve.
|
|
|
|
|
|
|
|
### Quick start
|
|
|
|
There are multiple ways to run kube-bench.
|
|
You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.
|
|
|
|
The supplied `job.yaml` [file](job.yaml) can be applied to run the tests as a job. For example:
|
|
|
|
```bash
|
|
$ kubectl apply -f job.yaml
|
|
job.batch/kube-bench created
|
|
|
|
$ kubectl get pods
|
|
NAME READY STATUS RESTARTS AGE
|
|
kube-bench-j76s9 0/1 ContainerCreating 0 3s
|
|
|
|
# Wait for a few seconds for the job to complete
|
|
$ kubectl get pods
|
|
NAME READY STATUS RESTARTS AGE
|
|
kube-bench-j76s9 0/1 Completed 0 11s
|
|
|
|
# The results are held in the pod's logs
|
|
kubectl logs kube-bench-j76s9
|
|
[INFO] 1 Master Node Security Configuration
|
|
[INFO] 1.1 API Server
|
|
...
|
|
```
|
|
For more information and different ways to run kube-bench see [documentation](docs/running.md)
|
|
### Please Note
|
|
|
|
1. kube-bench implements the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the [CIS community](https://cisecurity.org).
|
|
|
|
1. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See [CIS Kubernetes Benchmark support](docs/platforms.md#cis-kubernetes-benchmark-support) to see which releases of Kubernetes are covered by different releases of the benchmark.
|
|
|
|
|
|
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.
|
|
- see the following documentation on [Running kube-bench](docs/running.md#running-kube-bench) for more details.
|
|
|
|
|
|
## Contributing
|
|
Kindly read [Contributing](CONTRIBUTING.md) before contributing.
|
|
We welcome PRs and issue reports.
|
|
|
|
## Roadmap
|
|
|
|
Going forward we plan to release updates to kube-bench to add support for new releases of the CIS Benchmark. Note that these are not released as frequently as Kubernetes releases.
|