CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

CIS Benchmark Assessment with kube-bench

The CIS Kubernetes Benchmark is the compliance framework KCSA names, and kube-bench is how it is run. This guide runs it against the control plane, a worker and the policy section, reads the failures, checks one of them by hand - and finds that the section that matters most is the one a tool cannot score.

Compliance and Frameworks Guide 38 of 42 Intermediate

kube-bench v0.10.7, run as a Job. It selects the benchmark version from the cluster version automatically. The scanner needs the control-plane node and read-only host mounts, which makes it a privileged workload.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when compliance has to be measured rather than claimed. This matters because kube-bench scores a real cluster against the CIS Benchmark - and reading the failures matters more than the total, since several are one underlying thing and some cannot be scored at all.

Before you start

  1. Running the benchmark against the control plane

  2. The nine failures, four of which are one thing

  3. What WARN actually means

  4. Checking one finding by hand, and the fix it hands you

  5. The same benchmark, pointed at a worker

  6. The section a tool cannot score

Official sources

← All KCSA guides