What it does. Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-cis-benchmark-with-kube-bench, or copy the skill folder into ~/.claude/skills/performing-kubernetes-cis-benchmark-with-kube-bench/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md

SKILL.md (verbatim)

name: performing-kubernetes-cis-benchmark-with-kube-bench
description: >-
  Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting
  PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing
  remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled
  compliance audit, triaging kube-bench results, deciding which controls are not applicable on
  EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes
  Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster
  exception. Do not use for installing and running the tool - use
  benchmarking-kubernetes-with-kube-bench.
domain: cybersecurity
subdomain: container-security
tags:
- kube-bench
- cis-benchmark
- kubernetes
- compliance
- hardening
- aquasecurity
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525

Performing Kubernetes CIS Benchmark with kube-bench

Overview

kube-bench is an open-source Go tool by Aqua Security that runs the CIS Kubernetes Benchmark checks. It verifies control plane, etcd, worker node, and policy configurations against security best practices, producing actionable pass/fail/warn reports.

When to Use

• When conducting security assessments that involve performing kubernetes cis benchmark with kube bench
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Kubernetes cluster (v1.24+)
• kubectl with cluster-admin access
• Node access for direct runs or privileged pod access

Installation

# Binary installation
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.7.3/kube-bench_0.7.3_linux_amd64.tar.gz | tar xz
sudo mv kube-bench /usr/local/bin/

# Run as Kubernetes Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

# Run as a pod with host access
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-master.yaml
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-node.yaml

Running Benchmarks

Full Benchmark

# Run all checks (auto-detects node type)
kube-bench run

# Run with JSON output
kube-bench run --json > kube-bench-results.json

# Run with JUnit output for CI
kube-bench run --junit > kube-bench-results.xml

Component-Specific Checks

# Control plane (master) checks
kube-bench run --targets master

# Worker node checks
kube-bench run --targets node

# etcd checks
kube-bench run --targets etcd

# Policies checks
kube-bench run --targets policies

# Control plane + etcd
kube-bench run --targets master,etcd

Managed Kubernetes

# Amazon EKS
kube-bench run --benchmark eks-1.2.0

# Google GKE
kube-bench run --benchmark gke-1.4.0

# Azure AKS
kube-bench run --benchmark aks-1.0

# Red Hat OpenShift
kube-bench run --benchmark rh-1.0

Filtering Results

# Show only failures
kube-bench run --targets master | grep "\[FAIL\]"

# Run specific check
kube-bench run --check 1.2.1

# Run check group
kube-bench run --group 1.2

CIS Benchmark Sections

Section	Component	Key Checks
1.1	Control Plane - API Server	Anonymous auth, RBAC, audit logging
1.2	Control Plane - API Server	Admission controllers, encryption
1.3	Control Plane - Controller Manager	Service account tokens, bind address
1.4	Control Plane - Scheduler	Profiling, bind address
2.1	etcd	Client cert auth, peer encryption
3.1	Control Plane - Authentication	OIDC, client certs
4.1	Worker - kubelet	Anonymous auth, authorization
4.2	Worker - kubelet	TLS, read-only port
5.1	Policies - RBAC	Cluster-admin usage, service accounts
5.2	Policies - Pod Security	Privileged, host namespaces
5.3	Policies - Network	Network policies per namespace
5.7	Policies - General	Secrets, security context

Output Example

[INFO] 1 Control Plane Security Configuration
[INFO] 1.1 Control Plane Node Configuration Files
[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 600
[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root
[FAIL] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600
[WARN] 1.1.4 Ensure that the scheduler pod specification file permissions are set to 600

== Summary ==
45 checks PASS
12 checks FAIL
8 checks WARN
0 checks INFO

CI/CD Integration

GitHub Actions

name: CIS Benchmark
on:
  schedule:
    - cron: '0 6 * * 1'

jobs:
  kube-bench:
    runs-on: ubuntu-latest
    steps:
      - name: Configure kubectl
        uses: azure/setup-kubectl@v3

      - name: Run kube-bench
        run: |
          kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
          kubectl wait --for=condition=complete job/kube-bench --timeout=120s
          kubectl logs job/kube-bench > kube-bench-report.txt

      - name: Check for failures
        run: |
          FAILS=$(grep -c "\[FAIL\]" kube-bench-report.txt || true)
          echo "Failed checks: $FAILS"
          if [ "$FAILS" -gt 0 ]; then
            echo "::warning::$FAILS CIS benchmark checks failed"
          fi

      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: kube-bench-report
          path: kube-bench-report.txt

Remediation Examples

1.2.1 - Ensure --anonymous-auth is set to false

# /etc/kubernetes/manifests/kube-apiserver.yaml
spec:
  containers:
  - command:
    - kube-apiserver
    - --anonymous-auth=false

4.2.1 - Ensure --anonymous-auth is set to false on kubelet

# /var/lib/kubelet/config.yaml
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true

5.2.1 - Minimize wildcard RBAC

# Find roles with wildcard permissions
kubectl get clusterroles -o json | jq '.items[] | select(.rules[].resources[] == "*") | .metadata.name'

Best Practices

1. Run kube-bench before and after cluster provisioning
2. Schedule weekly scans via CronJob for drift detection
3. Export JSON for SIEM/compliance reporting
4. Fix FAIL items first, then address WARN items
5. Use benchmark profiles matching your Kubernetes distribution
6. Track score over time to measure security posture improvement
7. Combine with admission controllers to prevent drift

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

CIS Kubernetes Benchmark Compliance Tracker

Scan Schedule

Cluster	Environment	Frequency	Last Scan	Score
prod-us-east	Production	Weekly	YYYY-MM-DD	NN%
staging-us-east	Staging	Bi-weekly	YYYY-MM-DD	NN%
dev-cluster	Development	Monthly	YYYY-MM-DD	NN%

Remediation Tracking

Check ID	Description	Severity	Status	Owner	Due Date
1.2.1	Anonymous auth disabled	Critical	Open
1.2.6	RBAC authorization	Critical	Open
4.2.1	kubelet anonymous auth	High	Open
5.1.1	Cluster-admin role	High	Open

Accepted Risks

Check ID	Description	Justification	Approved By	Expiry

Score History

Date	Pass	Fail	Warn	Score
YYYY-MM-DD				%

references/api-reference.md (verbatim)

API Reference — Performing Kubernetes CIS Benchmark with kube-bench

Libraries Used

• subprocess: Execute kube-bench, kubectl commands
• json: Parse kube-bench JSON output and kubectl resource data

CLI Interface

python agent.py bench [--target master|node|etcd|policies] [--benchmark cis-1.8]
python agent.py pods [--namespace default]
python agent.py rbac
python agent.py netpol [--namespace default]

Core Functions

run_kube_bench(target, benchmark) — Execute CIS benchmark scan

Runs kube-bench with JSON output. Returns pass/fail/warn/info summary and compliance percentage. Targets: master, controlplane, node, etcd, policies.

check_pod_security(namespace) — Audit pod security contexts

Checks for: privileged containers, root user, writable root filesystem, dangerous capabilities (SYS_ADMIN, NET_ADMIN, ALL), privilege escalation.

check_rbac_config() — Audit cluster RBAC

Detects wildcard permissions (* verbs on * resources), pod creation rights, and cluster-admin bindings to service accounts/users.

check_network_policies(namespace) — Verify network segmentation

Flags namespaces with no NetworkPolicy. Lists policy coverage details.

Pod Security Issues Detected

Issue	Description
PRIVILEGED_CONTAINER	Container runs in privileged mode
RUNS_AS_ROOT	No runAsNonRoot constraint
WRITABLE_ROOT_FS	readOnlyRootFilesystem not set
DANGEROUS_CAPABILITIES	SYS_ADMIN/NET_ADMIN/ALL added
PRIVILEGE_ESCALATION_ALLOWED	allowPrivilegeEscalation not false

Dependencies

System: kube-bench (Aqua Security), kubectl with cluster access No Python packages required.

references/standards.md (verbatim)

Standards and References - Kubernetes CIS Benchmark with kube-bench

CIS Kubernetes Benchmark Versions

Benchmark Version	Kubernetes Versions	Released
CIS 1.8	1.27+	2023
CIS 1.7	1.25-1.26	2022
CIS 1.6	1.20-1.24	2021
EKS 1.2.0	EKS 1.23+	2023
GKE 1.4.0	GKE 1.25+	2023
AKS 1.0	AKS 1.24+	2023

NIST SP 800-53 Rev 5 Mappings

CIS Check	NIST Control	Description
1.2.1 Anonymous auth	AC-14	Permitted Actions without Authentication
1.2.6 RBAC	AC-3	Access Enforcement
1.2.22 Audit logging	AU-2, AU-3	Audit Events, Content of Audit Records
2.1 etcd encryption	SC-28	Protection of Information at Rest
4.2.1 kubelet auth	IA-2	Identification and Authentication
5.1 RBAC policies	AC-6	Least Privilege
5.2 Pod security	CM-7	Least Functionality
5.3 Network policies	SC-7	Boundary Protection

NSA/CISA Kubernetes Hardening Guide v1.2

• Section 1: Kubernetes Pod Security
• Section 2: Network Separation and Hardening
• Section 3: Authentication and Authorization
• Section 4: Audit Logging and Threat Detection

Compliance Frameworks

PCI DSS v4.0

• Req 2.2: Develop configuration standards for all system components
• Req 6.3.2: Develop software securely

SOC 2

• CC6.1: Logical access security for system components
• CC8.1: Change management controls

references/workflows.md (verbatim)

Workflow - Kubernetes CIS Benchmark with kube-bench

Phase 1: Initial Assessment

# Deploy kube-bench as Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl wait --for=condition=complete job/kube-bench --timeout=300s
kubectl logs job/kube-bench > baseline-report.txt
kubectl delete job kube-bench

Phase 2: Analyze Results

# Count results by status
PASS=$(grep -c "\[PASS\]" baseline-report.txt)
FAIL=$(grep -c "\[FAIL\]" baseline-report.txt)
WARN=$(grep -c "\[WARN\]" baseline-report.txt)
echo "PASS: $PASS | FAIL: $FAIL | WARN: $WARN"

# Extract failed checks with remediation
grep -A 2 "\[FAIL\]" baseline-report.txt

Phase 3: Remediate Failures

Priority order:

1. Control plane authentication (Section 1.2)
2. etcd security (Section 2)
3. Worker node kubelet (Section 4)
4. RBAC and policies (Section 5)

Apply each remediation, then re-run affected section:

kube-bench run --targets master --check 1.2.1

Phase 4: Continuous Monitoring

# kube-bench-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: kube-bench-scan
  namespace: security
spec:
  schedule: "0 6 * * 1"
  jobTemplate:
    spec:
      template:
        spec:
          hostPID: true
          containers:
          - name: kube-bench
            image: aquasec/kube-bench:v0.7.3
            command: ["kube-bench", "run", "--json"]
            volumeMounts:
            - name: var-lib-kubelet
              mountPath: /var/lib/kubelet
              readOnly: true
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
              readOnly: true
          volumes:
          - name: var-lib-kubelet
            hostPath:
              path: /var/lib/kubelet
          - name: etc-kubernetes
            hostPath:
              path: /etc/kubernetes
          restartPolicy: Never

Phase 5: Track Improvement

Compare PASS/FAIL/WARN counts across scans to measure security posture improvement over time.

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.