kube-bench

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

kube-bench (Aqua Security) runs the checks of the CIS Kubernetes Benchmark on a node: file permissions of manifests and certificates, API server flags (--anonymous-auth=false, --profiling=false, audit logging), kubelet settings, etcd TLS. Each check is PASS, FAIL, WARN or INFO, with a remediation text. There are profiles for kubeadm, EKS, AKS, GKE, k3s and RKE2.

It is part of CKS (cluster setup: fix the FAIL items it finds).

Zo schrijf je het

kube-bench [run] [--targets master,node,etcd,policies] [--benchmark NAME]

Belangrijkste delen

Targets

master: Control-plane components (API server, scheduler, controller manager).
node: kubelet and worker config.
etcd: etcd settings.
controlplane: Authentication and logging.
policies: RBAC, Pod Security, network policies, secrets.

Opties 7

Meest gebruikt

Flags

--targets LIST: Which parts to check.
--benchmark NAME: Benchmark version (cis-1.9, eks-1.5.0, aks-1.0, k3s-cis-1.8 …).
--check 1.2.1, 1.2.2: Only these checks.
--skip IDs: Skip checks.
--json / --junit: Output format.
--noremediations: Hide fix texts.
--outputfile FILE: Write to a file.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

1Run as a Kubernetes Job

$kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
$kubectl logs job/kube-bench | less

2Run on a control-plane node

#kube-bench run --targets master
[FAIL] 1.2.16 Ensure that the --profiling argument is set to false (Automated)

3Show only failures

#kube-bench run --targets master,node | grep -E "^\[FAIL\]"

4Fix a finding (example: profiling)

#vim /etc/kubernetes/manifests/kube-apiserver.yaml
    - --profiling=false
#kube-bench run --check 1.2.16

5Check one worker node
```
#kube-bench run --targets node
```

6Use the AKS profile

$kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-aks.yaml

7k3s profile
```
#kube-bench run --benchmark k3s-cis-1.8
```

8JSON report for tracking

#kube-bench run --json --outputfile kube-bench.json
$jq '.Totals' kube-bench.json

9Check kubelet file permissions by hand

#stat -c "%a %U:%G %n" /var/lib/kubelet/config.yaml /etc/kubernetes/kubelet.conf

10Check the API server audit flags

#grep -E "audit-log-path|audit-policy-file" /etc/kubernetes/manifests/kube-apiserver.yaml

Let op

After changing a static pod manifest, the API server restarts; a typo stops it — check with crictl ps.
Managed clusters (AKS/EKS) hide the control plane; only node and policy checks apply.

Bestanden

cfg/: Benchmark definitions (in the container or release).

Tips om te onthouden

Run it after every cluster upgrade and keep the JSON reports to show progress.

Exitcodes

`0`	Success (also when checks fail, unless --exit-code is set).
`1`	Error.

`kube-bench`

Wat het doet

Zo schrijf je het

Belangrijkste delen

Targets

Opties 7

Flags

Voorbeelden 10

1Run as a Kubernetes Job

2Run on a control-plane node

3Show only failures

4Fix a finding (example: profiling)

5Check one worker node

6Use the AKS profile

7k3s profile

8JSON report for tracking

9Check kubelet file permissions by hand

10Check the API server audit flags

Let op

Bestanden

Tips om te onthouden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Belangrijkste delen

Targets

Opties 7

Flags

Voorbeelden 10

1Run as a Kubernetes Job

2Run on a control-plane node

3Show only failures

4Fix a finding (example: profiling)

5Check one worker node

6Use the AKS profile

7k3s profile

8JSON report for tracking

9Check kubelet file permissions by hand

10Check the API server audit flags

Let op

Bestanden

Tips om te onthouden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Volledige handleiding

`kube-bench`