kube-bench: Kubernetes Security Auditing Tool - AI-Optimized Reference

Overview

kube-bench audits Kubernetes cluster security against CIS (Center for Internet Security) benchmarks. Performs ~100 security checks in 30 seconds to identify configuration vulnerabilities that could lead to cluster compromise.

Critical Security Failures Detected

API Server Vulnerabilities

• --anonymous-auth=true (default until K8s v1.6): Allows unauthenticated access
• --authorization-mode=AlwaysAllow: Bypasses all authorization checks
• Missing --enable-admission-plugins=PodSecurityPolicy: No pod security enforcement
• --insecure-bind-address=0.0.0.0: API server accessible without authentication

kubelet Security Issues

• Port 10255 exposed (disabled by default v1.10+): Metrics endpoint accessible to anyone
• --allow-privileged=true: Permits privileged container execution
• --anonymous-auth=true on kubelet: Unauthenticated kubelet access
• Config file /var/lib/kubelet/config.yaml with 644 permissions instead of 600

etcd Data Store Vulnerabilities

• --client-cert-auth=false: No TLS client authentication required
• Data directory /var/lib/etcd with 755 permissions: Readable by all users
• Unencrypted peer-to-peer communication: Internal traffic vulnerable to interception

Node-Level Security Gaps

• Docker socket /var/run/docker.sock with 666 permissions: Container escape vector
• vm.overcommit_memory=1: Memory exhaustion attacks possible
• Missing AppArmor/seccomp profiles: No container behavior restrictions

Performance and Resource Requirements

Execution Time: 20-30 seconds for complete audit
Memory Usage: ~50MB RAM
Network Impact: Minimal - primarily file system reads and process inspection
CPU Usage: Low - mostly grep operations and config file parsing

Cloud Platform Compatibility and Limitations

Platform	Failed Checks	Root Cause	Impact
Amazon EKS	47/100	AWS manages master nodes, no etcd access	Cannot verify control plane security
Azure AKS	39/100	Non-standard config paths, Container-Optimized OS	File permission checks fail
Google GKE	12/100	Minor file permission issues	Most comprehensive coverage
GKE Autopilot	78/100	Google locks down all configurations	Heavily restricted environment

Critical EKS Limitation: Error EACCES: permission denied, open '/var/lib/etcd/member/snap/db' occurs because AWS completely hides etcd access from customers.

Installation and Execution Methods

Kubernetes Job Method (Recommended)

apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench
spec:
  template:
    spec:
      hostPID: true
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      containers:
      - name: kube-bench
        image: aquasec/kube-bench:latest
        command: ["kube-bench"]
        volumeMounts:
        - name: var-lib-etcd
          mountPath: /var/lib/etcd
          readOnly: true
        - name: var-lib-kubelet
          mountPath: /var/lib/kubelet
          readOnly: true
      volumes:
      - name: var-lib-etcd
        hostPath:
          path: "/var/lib/etcd"
      - name: var-lib-kubelet
        hostPath:
          path: "/var/lib/kubelet"

Critical Requirements:

• hostPID: true: Required to read process command line arguments from /proc/$PID/cmdline
• restartPolicy: Never: Prevents infinite restart loops on failure
• Host path mounts: Necessary for accessing real filesystem configurations

Direct Binary Installation

curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.12.0/kube-bench_0.12.0_linux_amd64.tar.gz -o kube-bench.tar.gz
tar xzf kube-bench.tar.gz
sudo mv kube-bench /usr/local/bin/
sudo kube-bench --config-dir /opt/kube-bench/cfg

Common Failure Scenarios and Solutions

Permission Denied Errors

Error: permission denied: cannot access /proc/1234/cmdline
Solution: Run as root - kube-bench requires privileged access to inspect running processes

Error: no such file or directory: /var/lib/etcd
Solution: Use --benchmark eks flag for managed clusters or skip etcd tests

Error: config not found: /etc/kube-bench/cfg
Solution: Path changed in v0.11.0 - use --config-dir /opt/kube-bench/cfg

Cloud-Specific Issues

EKS: 47 failures expected due to AWS hiding master node access
AKS: Use --benchmark aks to handle Azure's non-standard paths
GKE Autopilot: 78% failure rate due to Google's security restrictions

CI/CD Integration Patterns

Intelligent Failure Thresholds

# Don't fail on normal cloud provider limitations
FAILURES=$(kube-bench --json | jq -r '.Totals.total_fail')
if [ "$FAILURES" -gt 15 ]; then
  echo "Too many failures: $FAILURES"
  exit 1
fi

Threshold Guidelines:

• 0 failures: Unrealistic, builds break constantly
• 5 failures: Too strict, breaks on normal cloud provider behavior
• 15 failures: Optimal - catches real problems without false positives

JSON Output Processing

kube-bench --json | jq -r '.Totals.total_fail' | xargs test 0 -eq

Compliance and Audit Requirements

Regulatory Framework Support

• SOC 2: Automated security controls documentation
• PCI DSS: Infrastructure security validation for payment processing
• HIPAA: Healthcare data protection infrastructure compliance
• FedRAMP: Government cloud security requirements
• NIST: Cybersecurity framework alignment

AWS Security Hub Integration

Use --asff flag for AWS Security Hub integration, but requires additional mapping to compliance frameworks.

Version and Benchmark Compatibility

Current Challenge: Tool typically lags 2-3 months behind Kubernetes releases
CIS Benchmark Versions: Multiple versions exist for different K8s versions
Auto-detection: Works most of the time, manual specification required when detection fails

Manual Override Example:

kube-bench --benchmark cis-1.23  # For K8s 1.28 using older benchmark

Customization and Configuration

Skipping Irrelevant Tests

Edit YAML files in /opt/kube-bench/cfg/ and add skip: true to unnecessary tests:

• Skip etcd tests (1.1.1-1.1.20) on EKS/managed clusters
• Skip kubelet config tests (4.2.1) on GKE due to non-standard paths

Custom Test Creation

Modify test YAML files with:

• commands: System commands to execute
• tests: Regex patterns to validate output
• remediation: Instructions for fixing failures

Tool Ecosystem Integration

Tool	Purpose	Performance Impact	Integration Complexity
kube-bench	Config audit	30 seconds, 50MB RAM	Low - file system only
kube-hunter	Active penetration testing	45 minutes, can crash clusters	High - requires careful staging
Kubescape	Multi-purpose security scanning	500MB binary, complex config	Very High - 20-page configuration
Falco	Runtime threat detection	Kernel module, 1000+ daily alerts	Extreme - breaks on OS updates
Trivy	Container vulnerability scanning	Varies by image size	Medium - registry integration

Production Deployment Considerations

Resource Planning

• Memory: 50MB per execution
• CPU: Minimal - primarily I/O bound
• Storage: Negligible - tool reads existing files
• Network: Low impact - local file system operations

Frequency Recommendations

• After configuration changes: Immediate validation
• CI/CD pipeline: Every deployment to staging
• Scheduled audits: Weekly for compliance
• Incident response: On-demand during security events

Multi-cluster Management

• Different cloud providers show different failure patterns
• Automation required for dozens of clusters
• Centralized result collection needed for enterprise scale

Critical Warnings and Limitations

Breaking Changes That Cause Outages

Real Incident: Setting --anonymous-auth=false on kubelet broke Prometheus monitoring that relied on anonymous access to port 10255 for 2 years. 4-hour production monitoring outage resulted.

Cloud Provider Restrictions

• AWS EKS: Cannot access etcd, 47 expected failures
• Azure AKS: Non-standard file paths cause permission failures
• GKE Autopilot: 78% failure rate due to Google's security model

Security Team Concerns

hostPID: true and privileged access requirements cause security team resistance, but tool cannot function without these permissions.

Support and Maintenance

Open Source: Active GitHub community, responsive maintainers
Commercial: Aqua Security offers paid support with SLAs
Updates: Regular releases for new Kubernetes/CIS versions, typically 2-3 month lag
Documentation: Comprehensive GitHub repository with cloud-specific examples

Key Resources

• Primary Repository: https://github.com/aquasecurity/kube-bench
• CIS Kubernetes Benchmark: Official 300-page compliance specification
• Cloud Job Configs: Pre-built YAML for EKS, GKE, AKS in repository
• Trivy Integration: Complementary container vulnerability scanning tool