is deployed securely by running the checks documented in the as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the to see which releases of Kubernetes are covered by different releases of the benchmark.
It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.
.
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine, but please note that kube-bench does not automatically detect OpenShift and GKE - see the section below on ,compile it from source.
Running kube-bench
If you run kube-bench directly from the version as indicated by the mapping table above. For example, if you specify
Alternatively, you can specify
If you want to target specific CIS Benchmark
or
The following table shows the valid targets based on the CIS Benchmark version.
If no targets are specified,
Note:
Running inside a container
You can avoid installing kube-bench on the host by running it inside a container using the host PID namespace and mounting the
You can use your own configs by mounting them over the default ones in
Running in a Kubernetes cluster
You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.
Master nodes are automatically detected by kube-bench and will run master checks when possible. The detection is done by verifying that mandatory components for master, as defined in the config files, are running (see ) to shell into a node
Run CIS benchmark to view results:
kube-bench cannot be run on AKS master nodes
Running in an EKS cluster
There is a
| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
|---|---|---|
| cis-1.4 | 1.13-1.14 | |
| gke-1.0 | GKE | |
| Red Hat OpenShift hardening guide | rh-0.7 | OCP 3.10-3.11 |
Running kube-bench
If you run kube-bench directly from the version as indicated by the mapping table above. For example, if you specify
--version 1.13, this is mapped to CIS Benchmark version cis-1.14.Alternatively, you can specify
--benchmark to run a specific CIS Benchmark version: CODE
kube-bench node --benchmark cis-1.4target (i.e master, node, etcd, etc...) you can use the run --targets subcommand. CODE
kube-bench --benchmark cis-1.4 run --targets master,node CODE
kube-bench --benchmark cis-1.5 run --targets master,node,etcd,policies| CIS Benchmark | Targets |
|---|---|
| cis-1.3 | master, node |
| cis-1.4 | master, node |
| cis-1.5 | master, controlplane, node, etcd, policies |
| gke-1.0 | master, controlplane, node, etcd, policies, managedservices |
kube-bench will determine the appropriate targets based on the CIS Benchmark version.controls for the various versions of CIS Benchmark can be found in directories with same name as the CIS Benchmark versions under cfg/, for example cfg/cis-1.4.Note:
It is an error to specify both --version and --benchmark flags togetherRunning inside a container
You can avoid installing kube-bench on the host by running it inside a container using the host PID namespace and mounting the
/etc and /var directories where the configuration and other files are located on the host so that kube-bench can check their existence and permissions. CODE
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node] --version 1.13Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl to resolve this. You will also need to pass in kubeconfig credentials. For example: CODE
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node] /opt/kube-bench/cfg/ CODE
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]Running in a Kubernetes cluster
You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.
Master nodes are automatically detected by kube-bench and will run master checks when possible. The detection is done by verifying that mandatory components for master, as defined in the config files, are running (see ) to shell into a node
kubectl-enter {node-name} or ssh to one agent node could open nsg 22 port and assign a public ip for one agent node (only for testing purpose) CODE
docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install
./kube-bench nodeRunning in an EKS cluster
There is a
job-eks.yaml file for running the kube-bench node checks on an EKS cluster. The significant difference on EKS is that it's not possible to schedule jobs onto the master node, so master checks can't be performed- To create an EKS Cluster refer to ):CODE
go get github.com/aquasecurity/kube-bench
cd $GOPATH/src/github.com/aquasecurity/kube-bench
go build -o kube-bench .
# See all supported options
./kube-bench --help
# Run all checks
./kube-bench
Running on OpenShiftOpenShift .
Test config YAML representation
The tests (or "controls") are represented as YAML documents (installed by default into./cfg). There are different versions of these test YAML files reflecting different versions of the CIS Kubernetes Benchmark. You will find more information about the test file YAML definitions in our cluster. This can be very handy if you don't want to run a real Kubernetes cluster for development purposes.
First, you'll need to create the cluster usingmake kind-test-clusterthis will create a new cluster if it cannot be found on your machine. By default, the cluster is namedkube-benchbut you can change the name by using the environment variableKIND_PROFILE.
If kind cannot be found on your system the target will try to install it usinggo get
Next, you'll have to build the kube-bench docker image usingmake build-docker, then we will be able to push the docker image to the cluster usingmake kind-push.
Finally, we can use themake kind-runtarget to run the current version of kube-bench in the cluster and follow the logs of pods created. (Ctrl+C to exit)
Every time you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. (make build-docker kind-push kind-run)
Contributing
Bugs
If you think you have found a bug please follow the instructions below.- Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate.
- Open a .
- Remember users might be searching for your issue in the future, so please give it a meaningful title to helps others.
- Clearly define the use case, using concrete examples. For example, I type
thisand kube-bench doesthat. - If you would like to include a technical design for your feature please feel free to do so.
Pull Requests
We welcome pull requests!- Your PR is more likely to be accepted if it focuses on just one change.
- Please include a comment with the results before and after your change.
- Your PR is more likely to be accepted if it includes tests. (We have not historically been very strict about tests, but we would like to improve this!).
- You're welcome to submit a draft PR if you would like early feedback on an idea or an approach.
- Happy coding!
↗ Original-Artikel auf feedproxy.google.com lesenVollständiger Original-BerichtAusführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf feedproxy.google.com.Wie bewertest du diesen Beitrag?1 Klick FeedbackTeilen mit Netzwerk & Team:Community-Analysen & Experten-Meinungen 0
Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf „ Eigene Analyse verfassen“!Community Pulse: Relevanz-Einschätzung1 Klick Experten-Votum🔴 Akute Relevanz 0%🟡 In Evaluierung 0%🟢 Keine Auswirkung 0%Spannende Innovation 0%Port 8095 EngineVerwandte Story-Cluster & Quellen (Vektor-KI)
Tipp: Mit Pfeiltasten [ ← ] und [ → ] blättern
Ähnliche Beiträge
🔍 Verwandte NewsAuch interessante Nachrichten Kube-Bench - Checks Whether Kubernetes Is Deployed According To Security Best Practices As Defined In The CIS Kubernetes Benchmark
Thematisch verwandte Begriffe: KubeBench, Checks, Whether, Kubernetes · 6 Treffer
🔧 AI Nachrichten MacDailyNewsApple accuses OpenAI of destroying evidence as trade-secrets fight intensifies
🔧 AI Nachrichten The Mac ObserverGPT-6 Astra Release Today? OpenAI’s Next Major AI Model Is Almost Here
Laden...Videos werden geladen ...
Laden...Beiträge werden geladen ...
Laden...Videos werden geladen ...
Laden...Beiträge werden geladen ...
Laden...Videos werden geladen ...
Laden...Beiträge werden geladen ...
Laden...Videos werden geladen ...
Laden...Beiträge werden geladen ...
Laden...Videos werden geladen ...
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.📂 News ⏱️ 3 Min vor 10 MinArtikeldaten werden geladen...Zum Aktualisieren ziehen
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms LadezeitInstalliere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.
Nächster Beitrag🤖Community Radar & Live Chat
Sentinel Bot online • Live-StreamDein Cluster: Security Explorer👥 Match:lädt…Verbindung zum Community-Stream wird aufgebaut...📡 Aktivitäten deiner Analysten
lädt…💡 Neues Thema oder Eilmeldung einreichen
Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.
🔥 Heiß diskutierte Einreichungen
SOCIAL SHARE CARD GENERATOR