Overview

kube-bench is an open source command line tool from Aqua Security that checks whether a Kubernetes cluster is deployed securely. It runs the controls documented in the CIS Kubernetes Benchmark against a node and reports every control as PASS, FAIL, WARN or INFO, so an operator can see precisely which hardening steps are still missing.

The controls are not compiled into the binary. They are expressed as YAML control files, grouped by benchmark version and by target (control plane, worker node, etcd, policies), which makes kube-bench easy to extend and easy to keep in step with a new CIS revision without rebuilding the scanner.

Key Features

• Automates the CIS Kubernetes Benchmark controls into a repeatable, scriptable scan
• YAML-based control definitions, selectable per benchmark version and per target
• Auto-detects the Kubernetes version and the components running on the node (kubelet, kube-apiserver) and picks the matching control set; --benchmark and --version override the detection
• Many benchmark profiles ship in the box: cis-1.x, EKS, GKE, AKS, ACK, k3s-cis, RKE, RKE2, TKGI, Red Hat OpenShift and the EKS STIG
• Fine-grained selection flags: --targets, --check, --skip, --group, --scored / --unscored
• Readable console report with per-control remediation text (--noremediations hides it) and a PASS / FAIL / WARN / INFO summary
• Machine-readable output: --json, --junit, --outputfile, plus direct delivery of results to AWS Security Hub (--asff) and PostgreSQL (--pgsql)
• Controllable exit code (--exit-code) so a pipeline can fail a build when a scored control fails
• Shipped as a single static Go binary for Linux (amd64, arm64, armv6, armv7, ppc64le, s390x) and macOS, as .deb / .rpm packages and as the container image docker.io/aquasec/kube-bench
• Runs directly on a host, or as a Kubernetes Job inside the cluster (the supplied job.yaml); a containerised run needs the host PID namespace and read-only /etc and /var mounts to inspect host files

Why Use It

Hardening a cluster normally means working through a several-hundred-page benchmark by hand. kube-bench turns the same controls into a scan you can run before a cluster goes live, after every Kubernetes upgrade and on a schedule. Because each control is a YAML file you can read and diff, the result is reproducible and auditable: the same node configuration produces the same findings.

It is also the reference implementation of the CIS Kubernetes Benchmark, maintained by Aqua Security and re-synchronised as CIS publishes new revisions, so the controls stay current rather than drifting.

Use Cases

• Baseline a freshly provisioned kubeadm, k3s, RKE2 or Talos cluster and fix the FAILs before exposing workloads
• Continuous compliance: run the Job on a schedule and ship the --json report to a SIEM, Security Hub or database
• CI/CD gate: scan a test cluster in the pipeline and fail the build on critical scored controls
• Drift detection after a Kubernetes minor upgrade, where previously passing controls can start warning
• Worker node checks on managed clusters such as EKS, GKE and AKS, where the control plane nodes themselves cannot be inspected

Platforms and Requirements

• Linux (amd64, arm64, armv6, armv7, ppc64le, s390x) and macOS; container image also available
• Needs root or sudo on the node to read the Kubernetes configuration files, or a pod with the host directories mounted read-only
• Either kubelet / kubectl on the PATH, or an explicit --version / --benchmark

Licence and Website

kube-bench is free and open source software, released under the Apache License 2.0. It is developed by Aqua Security; the CIS Kubernetes Benchmark it implements is published separately by the Center for Internet Security.

• Source code: github.com/aquasecurity/kube-bench
• Documentation: Running kube-bench

Alternatives

• Trivy, from the same project family, is an all in one cloud native scanner whose CLI and Kubernetes Operator both include CIS Kubernetes Benchmark scanning alongside vulnerability and misconfiguration scanning
• Kubescape (ARMO) and Polaris (Fairwinds) cover overlapping Kubernetes configuration and posture checks and are worth comparing against kube-bench

Explore Further

Browse more self-hosted security and privacy tooling in the full directory, or submit a tool of your own.