CIS benchmark tool Kube bench

CIS Safety benchmark

CIS Official website : https://www.cisecurity.org/
K8S CIS The benchmark : https://www.cisecurity.org/benchmark/kubernetes

CIS Benchmarking tools kube-bench

Project address : https://github.com/aquasecurity/kube-bench

kube-bench Basic use

#  see kube-bech Using parameters of 
kube-bench --help

Test project configuration file

/etc/kube-bench/cfg/ yes kube-bench Directory of project test configuration files .

test master

kube-apiserver To configure Reference address : https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver/
kube-apiserver The configuration file :/etc/kubernetes/manifests/kube-apiserver.yaml

#  Yes master To test 
kube-bench run -s master

#  Yes master Test and display only FAIL
kube-bench master|grep FAIL

test node

Kubelet To configure Reference address : https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kubelet/

Kubelet The configuration file :/etc/kubernetes/kubelet.conf

#  Yes node To test 
kube-bench run -s node

test ETCD

#  Yes etcd To test 
kube-bench run -s etcd