1
0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-18 20:58:10 +00:00
The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed according to security best practices.
Go to file
dependabot[bot] 900d248650
Bump github.com/aws/aws-sdk-go from 1.41.15 to 1.41.19 (#1044)
Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.41.15 to 1.41.19.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Changelog](https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-go/compare/v1.41.15...v1.41.19)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2021-11-14 11:36:09 +02:00
.github Support arm64 architecture (#1036) 2021-11-08 14:06:44 +02:00
cfg Fix status of cis-1.20 4.1.6 should be Automated (#1041) 2021-11-08 11:25:59 +02:00
check Fix experimental-encryption-provider-config test on OCP 3.11 - Issue #926 (#1024) 2021-10-27 12:56:00 +03:00
cmd Allow for usage of env var K8S_HOST in psql (#1026) 2021-10-27 13:32:10 +03:00
docs doc(install): Adding detail and example for build (#928) 2021-07-07 10:56:33 +03:00
hack retire cis 1.3 and 1.4 (#693) 2020-10-03 11:23:28 +01:00
hooks adds kube-bench version to docker build hook (#524) 2019-11-27 20:06:42 +00:00
integration/testdata Fix status of cis-1.20 4.1.6 should be Automated (#1041) 2021-11-08 11:25:59 +02:00
internal/findings Aws asff (#770) 2020-11-23 19:43:53 +00:00
.gitignore fix integration test not testing latest code and can't run test on local (#1011) 2021-10-03 11:43:43 +03:00
.goreleaser.yml Update goreleaser (#929) 2021-07-14 15:50:12 +03:00
.yamllint.yaml Support Linting YAML as part of Travis CI build (#554) 2020-01-06 09:18:25 +00:00
codecov.yml Improve Proxykubeconfig tests (#708) 2020-10-07 21:53:34 +03:00
CONTRIBUTING.md mkdocs support and update docs (#884) 2021-06-09 11:17:16 +03:00
Dockerfile Bump golang from 1.17.2 to 1.17.3 (#1043) 2021-11-11 13:43:16 +02:00
entrypoint.sh Set -e to fail fast 2018-05-11 13:44:04 -04:00
go.mod Bump github.com/aws/aws-sdk-go from 1.41.15 to 1.41.19 (#1044) 2021-11-14 11:36:09 +02:00
go.sum Bump github.com/aws/aws-sdk-go from 1.41.15 to 1.41.19 (#1044) 2021-11-14 11:36:09 +02:00
job-ack.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job-aks.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job-eks-asff.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job-eks.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job-gke.yaml Fix 4.1.9, skip irremediable checks, add /home/kubernetes mount (#976) 2021-08-30 15:33:59 +03:00
job-iks.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job-master.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job-node.yaml K8s Job Command Clean (#923) 2021-07-07 18:21:30 +03:00
job.yaml New integration testing (#947) 2021-08-03 17:10:50 +03:00
LICENSE Initial commit 2017-06-19 17:01:57 +03:00
main.go Fix issue #16 about supporting verbosity. 2017-07-07 17:01:30 +00:00
makefile Support arm64 architecture (#1036) 2021-11-08 14:06:44 +02:00
mkdocs.yml Fixing typos (#899) 2021-06-09 15:11:05 +03:00
NOTICE Create NOTICE (#199) 2019-01-16 10:53:07 +02:00
OWNERS Create OWNERS 2017-08-11 16:06:44 +01:00
README.md fix typo in readme (#917) 2021-09-29 15:06:23 +03:00

GitHub Release Downloads Docker Pulls Go Report Card Build Status License Docker image Source commit Coverage Status

kube-bench logo

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Tests are configured with YAML files, making this tool easy to update as test specifications evolve.

Kubernetes Bench for Security

Quick start

There are multiple ways to run kube-bench. You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.

The supplied job.yaml file can be applied to run the tests as a job. For example:

$ kubectl apply -f job.yaml
job.batch/kube-bench created

$ kubectl get pods
NAME                      READY   STATUS              RESTARTS   AGE
kube-bench-j76s9   0/1     ContainerCreating   0          3s

# Wait for a few seconds for the job to complete
$ kubectl get pods
NAME                      READY   STATUS      RESTARTS   AGE
kube-bench-j76s9   0/1     Completed   0          11s

# The results are held in the pod's logs
kubectl logs kube-bench-j76s9
[INFO] 1 Master Node Security Configuration
[INFO] 1.1 API Server
...

For more information and different ways to run kube-bench see documentation

Please Note

  1. kube-bench implements the CIS Kubernetes Benchmark as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the CIS community.

  2. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See CIS Kubernetes Benchmark support to see which releases of Kubernetes are covered by different releases of the benchmark.

By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.

Contributing

Kindly read Contributing before contributing. We welcome PRs and issue reports.

Roadmap

Going forward we plan to release updates to kube-bench to add support for new releases of the CIS Benchmark. Note that these are not released as frequently as Kubernetes releases.