# Kube-Bench | Checks Whether Kubernetes Is Deployed According To Security Best Practices As Defined In The CIS Kubernetes Benchmark

**URL:** <https://onehack.st/t/kube-bench-checks-whether-kubernetes-is-deployed-according-to-security-best-practices-as-defined-in-the-cis-kubernetes-benchmark/94734>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [July 1, 2020, 3:21pm UTC](https://onehack.st/t/kube-bench-checks-whether-kubernetes-is-deployed-according-to-security-best-practices-as-defined-in-the-cis-kubernetes-benchmark/94734 "2020-07-01T15:21:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [July 1, 2020, 3:21pm UTC](https://onehack.st/t/kube-bench-checks-whether-kubernetes-is-deployed-according-to-security-best-practices-as-defined-in-the-cis-kubernetes-benchmark/94734/1 "2020-07-01T15:21:27Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/4/7/477c646d19a03962d806a0ca1d7f41e5ea9786de.png)

kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).

Tests are configured with YAML files, making this tool easy to update as test specifications evolve.

### Please Note

1. kube-bench implements the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the [CIS community](https://cisecurity.org/).
2. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See [CIS Kubernetes Benchmark support](https://github.com/aquasecurity/kube-bench#cis-kubernetes-benchmark-support) to see which releases of Kubernetes are covered by different releases of the benchmark.
3. It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.

 ![image](https://onehack.st/uploads/default/original/3X/8/f/8f45aa6e485eebb264a73c7e7568dcff333256d0.png)

# Table of Contents

- [CIS Kubernetes Benchmark support](https://github.com/aquasecurity/kube-bench#cis-kubernetes-benchmark-support)
- [Installation](https://github.com/aquasecurity/kube-bench#installation)
- [Running kube-bench](https://github.com/aquasecurity/kube-bench#running-kube-bench)
  - [Running inside a container](https://github.com/aquasecurity/kube-bench#running-inside-a-container)
  - [Running in a kubernetes cluster](https://github.com/aquasecurity/kube-bench#running-in-a-kubernetes-cluster)
  - [Running in an Azure Kubernetes Service(AKS) cluster](https://github.com/aquasecurity/kube-bench#running-in-an-aks-cluster)
  - [Running in an EKS cluster](https://github.com/aquasecurity/kube-bench#running-in-an-eks-cluster)
  - [Installing from a container](https://github.com/aquasecurity/kube-bench#installing-from-a-container)
  - [Installing from sources](https://github.com/aquasecurity/kube-bench#installing-from-sources)

- [Running on OpenShift](https://github.com/aquasecurity/kube-bench#running-on-openshift)
- [Output](https://github.com/aquasecurity/kube-bench#output)
- [Configuration](https://github.com/aquasecurity/kube-bench#configuration)
- [Test config YAML representation](https://github.com/aquasecurity/kube-bench#test-config-yaml-representation)
  - [Omitting checks](https://github.com/aquasecurity/kube-bench#omitting-checks)

- [Roadmap](https://github.com/aquasecurity/kube-bench#roadmap)
- [Testing locally with kind](https://github.com/aquasecurity/kube-bench#testing-locally-with-kind)
- [Contributing](https://github.com/aquasecurity/kube-bench#contributing)
  - [Bugs](https://github.com/aquasecurity/kube-bench#bugs)
  - [Features](https://github.com/aquasecurity/kube-bench#features)
  - [Pull Requests](https://github.com/aquasecurity/kube-bench#pull-requests)

## CIS Kubernetes Benchmark support

kube-bench supports the tests for Kubernetes as defined in the [CIS Kubernetes Benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).

| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
| --- | --- | --- |
| [1.3.0](https://workbench.cisecurity.org/benchmarks/602) | cis-1.3 | 1.11-1.12 |
| [1.4.1](https://workbench.cisecurity.org/benchmarks/2351) | cis-1.4 | 1.13-1.14 |
| [1.5.0](https://workbench.cisecurity.org/benchmarks/1370) | cis-1.5 | 1.15- |
| [GKE 1.0.0](https://workbench.cisecurity.org/benchmarks/4536) | gke-1.0 | GKE |
| Red Hat OpenShift hardening guide | rh-0.7 | OCP 3.10-3.11 |

By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine, but please note that kube-bench does not automatically detect OpenShift and GKE - see the section below on [Running kube-bench](https://github.com/aquasecurity/kube-bench#running-kube-bench).

## Installation

You can choose to

- run kube-bench from inside a container (sharing PID namespace with the host)
- run a container that installs kube-bench on the host, and then run kube-bench directly on the host
- install the latest binaries from the [Releases page](https://github.com/aquasecurity/kube-bench/releases),
- compile it from source.

## Running kube-bench

If you run kube-bench directly from the command line you may need to be root / sudo to have access to all the config files.

kube-bench automatically selects which `controls` to use based on the detected node type and the version of Kubernetes a cluster is running. This behavior can be overridden by specifying the `master` or `node` subcommand and the `--version` flag on the command line.

The Kubernetes version can also be set with the `KUBE_BENCH_VERSION` environment variable. The value of `--version` takes precedence over the value of `KUBE_BENCH_VERSION` .

For example, run kube-bench against a master with version auto-detection:

## GitHub:

> **[GitHub - aquasecurity/kube-bench: Checks whether Kubernetes is deployed according to...](https://github.com/aquasecurity/kube-bench)**
>
> Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

Continue there…