/PLAYBOOK · 2026-08-19

Kube-bench in Practice: Kubernetes Cluster Security Baseline Scan Configuration Guide

How to use Kube-bench: automated CIS Kubernetes Benchmark scans of control plane, etcd, and worker nodes. Install, scan, interpret results, and remediate to continuously assess cluster compliance.

Scope

Kube-bench baseline scans apply to all Kubernetes ops and security teams: rapid cluster security inventory before MLPS or CIS audits, periodic config-drift checks after go-live, and automated replacement of manual kube-apiserver flag review during assessments. Kube-bench runs 200+ checks against CIS Kubernetes Benchmark covering control-plane components, etcd, worker nodes, and RBAC, and emits actionable remediations. Standard cluster security health-check tool.

Prerequisites

Reachable Kubernetes cluster (v1.20+); kubeconfig admin recommended (typically cluster-admin, or at least node access)

Command execution on control-plane and worker nodes (SSH or privileged Pod)

Docker or containerd on nodes, to run Kube-bench as a container

Kube-bench binary or image: aquasec/kube-bench

Mechanism

CIS Kubernetes Benchmark splits security config by component. Each check has applicable version, expected config, and scoring (Scored/Not Scored). Kube-bench auto-matches the benchmark file for the cluster version (cis-x.x under config/), then collects actual config by: reading static Pod manifests or systemd args for kube-apiserver, kube-controller-manager, kube-scheduler, etcd; checking certs and file perms under /etc/kubernetes; querying kubelet and kubectl for runtime state. Results are PASS, FAIL, WARN, INFO. FAIL items are defects to fix.

Procedure

Step 1: Install Kube-bench

Prefer the official container image—one command, no node pollution:

# Run on control-plane node (auto-detects version and benchmark)
docker run --rm -it \
  -v /etc/kubernetes:/etc/kubernetes:ro \
  -v /var/lib/etcd:/var/lib/etcd:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  aquasec/kube-bench:latest run

If the node uses containerd instead of Docker, drop the docker.sock mount. Binary install:

curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.9.3/kube-bench_0.9.3_linux_amd64.tar.gz | tar xz
./kube-bench run

Step 2: Parse scan results

After the scan, the terminal prints summaries by Master / Control Plane, Worker Node, Policies (RBAC):

== Summary ==
0 checks PASS
25 checks FAIL
9 checks WARN
0 checks INFO

Results also emit JSON for archival (`--json`). Save to a dedicated directory:

./kube-bench run --json > kube-bench-$(date +%F).json

Step 3: Remediate high-frequency FAIL items

Most FAILs cluster on missing kube-apiserver flags. Three most common remediations:

# 1) 2.1 Audit log not enabled: edit /etc/kubernetes/manifests/kube-apiserver.yaml
- --audit-log-path=/var/log/kubernetes/audit.log
- --audit-log-maxage=30
- --audit-log-maxbackup=10
- --audit-log-maxsize=100

# 2) 1.2.1 Anonymous requests not disabled: verify --anonymous-auth=false
# 3) 4.1.1 kubelet anonymous access: edit /var/lib/kubelet/config.yaml
authentication:
  anonymous:
    enabled: false

After edits, apiserver and kubelet restart automatically (static Pod manifest changes take effect in seconds). Rescan to confirm.

Step 4: Schedule periodic scans

Use a CronJob for weekly auto-scan and result push. Create cronjob-kube-bench.yaml:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kube-bench
  namespace: kube-system
spec:
  schedule: "0 2 * * 1"   # 02:00 every Monday
  jobTemplate:
    spec:
      template:
        spec:
          hostPID: true
          containers:
          - name: kube-bench
            image: aquasec/kube-bench:latest
            args: ["run", "--json"]
            volumeMounts:
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
            - name: var-lib-etcd
              mountPath: /var/lib/etcd
          restartPolicy: Never
          volumes:
          - name: etc-kubernetes
            hostPath:
              path: /etc/kubernetes
          - name: var-lib-etcd
            hostPath:
              path: /var/lib/etcd

kubectl apply -f cronjob-kube-bench.yaml

Verification

# 1) Verify benchmark version match
./kube-bench run --version    # prints current K8s version and matched CIS benchmark version

# 2) Verify audit log is in effect
ls -la /var/log/kubernetes/audit.log && tail -5 /var/log/kubernetes/audit.log

# 3) Verify anonymous access is disabled
kubectl --token=xxx --server=https://127.0.0.1:6443 get nodes
# Wrong/anonymous token should return 401 Unauthorized

FAQ

FAQ 1: Will a Kube-bench scan affect cluster operation?

No. Kube-bench reads config read-only (all mounts :ro). It does not change component flags or restart services. The only caveat is mounting /var/lib/etcd to read etcd data-dir config—read-only. Safe on production clusters.

FAQ 2: Managed clusters (EKS, ACK) show mass FAILs. What then?

Control plane is vendor-managed; apiserver flags cannot be changed. Treat those FAILs as unfixable and accept the risk. Use a custom benchmark via config, `skip` managed-component checks, and focus on fixable node and RBAC items.

Summary

Kube-bench turns CIS Kubernetes Benchmark into a one-command routine check at minimal cost: zero-install container run, archivable JSON, automatable CronJob. Recommended flow: first scan, fix Scored+FAIL items first (audit log, anonymous access, RBAC least privilege); then weekly auto-scan vs baseline to catch config drift.