kube-bench

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

kube-bench (Aqua Security) runs the checks of the CIS Kubernetes Benchmark on a node: file permissions of manifests and certificates, API server flags (--anonymous-auth=false, --profiling=false, audit logging), kubelet settings, etcd TLS. Each check is PASS, FAIL, WARN or INFO, with a remediation text. There are profiles for kubeadm, EKS, AKS, GKE, k3s and RKE2.

It is part of CKS (cluster setup: fix the FAIL items it finds).

طريقة الكتابة

kube-bench [run] [--targets master,node,etcd,policies] [--benchmark NAME]

الأجزاء الرئيسية

Targets

master: Control-plane components (API server, scheduler, controller manager).
node: kubelet and worker config.
etcd: etcd settings.
controlplane: Authentication and logging.
policies: RBAC, Pod Security, network policies, secrets.

الخيارات 7

الأكثر استخدامًا

Flags

--targets LIST: Which parts to check.
--benchmark NAME: Benchmark version (cis-1.9, eks-1.5.0, aks-1.0, k3s-cis-1.8 …).
--check 1.2.1, 1.2.2: Only these checks.
--skip IDs: Skip checks.
--json / --junit: Output format.
--noremediations: Hide fix texts.
--outputfile FILE: Write to a file.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Run as a Kubernetes Job

$kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
$kubectl logs job/kube-bench | less

2Run on a control-plane node

#kube-bench run --targets master
[FAIL] 1.2.16 Ensure that the --profiling argument is set to false (Automated)

3Show only failures

#kube-bench run --targets master,node | grep -E "^\[FAIL\]"

4Fix a finding (example: profiling)

#vim /etc/kubernetes/manifests/kube-apiserver.yaml
    - --profiling=false
#kube-bench run --check 1.2.16

5Check one worker node
```
#kube-bench run --targets node
```

6Use the AKS profile

$kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-aks.yaml

7k3s profile
```
#kube-bench run --benchmark k3s-cis-1.8
```

8JSON report for tracking

#kube-bench run --json --outputfile kube-bench.json
$jq '.Totals' kube-bench.json

9Check kubelet file permissions by hand

#stat -c "%a %U:%G %n" /var/lib/kubelet/config.yaml /etc/kubernetes/kubelet.conf

10Check the API server audit flags

#grep -E "audit-log-path|audit-policy-file" /etc/kubernetes/manifests/kube-apiserver.yaml

انتبه

After changing a static pod manifest, the API server restarts; a typo stops it — check with crictl ps.
Managed clusters (AKS/EKS) hide the control plane; only node and policy checks apply.

الملفات

cfg/: Benchmark definitions (in the container or release).

نصائح للحفظ

Run it after every cluster upgrade and keep the JSON reports to show progress.

رموز الخروج

`0`	Success (also when checks fail, unless --exit-code is set).
`1`	Error.

`kube-bench`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Targets

الخيارات 7

Flags

أمثلة 10

1Run as a Kubernetes Job

2Run on a control-plane node

3Show only failures

4Fix a finding (example: profiling)

5Check one worker node

6Use the AKS profile

7k3s profile

8JSON report for tracking

9Check kubelet file permissions by hand

10Check the API server audit flags

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Targets

الخيارات 7

Flags

أمثلة 10

1Run as a Kubernetes Job

2Run on a control-plane node

3Show only failures

4Fix a finding (example: profiling)

5Check one worker node

6Use the AKS profile

7k3s profile

8JSON report for tracking

9Check kubelet file permissions by hand

10Check the API server audit flags

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`kube-bench`