cloudthinker-ai CIS Benchmark for Kubernetes Skill
Run CIS Kubernetes Benchmark v1.8 assessment for cluster {{ cluster_name }} ({{ k8s_version }}, {{ distribution | "self-managed" }}).
Workflow
Step 1 — Assessment Context
- Cluster: {{ cluster_name }}
- Version: {{ k8s_version }}
- Distribution: {{ distribution | "self-managed" }}
- Note: For managed services (EKS/GKE/AKS), control plane checks are provider-managed. Focus on worker node and workload checks.
Step 2 — Control Plane Configuration
CONTROL PLANE (Section 1)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
API SERVER
[ ] 1.1 — Anonymous auth disabled (--anonymous-auth=false)
[ ] 1.2 — Basic auth file not used
[ ] 1.3 — Token auth file not used
[ ] 1.4 — RBAC authorization enabled
[ ] 1.5 — NodeRestriction admission plugin enabled
[ ] 1.6 — Audit logging enabled with appropriate policy
[ ] 1.7 — AlwaysAdmit admission controller not set
[ ] 1.8 — Encryption provider configured for secrets at rest
[ ] 1.9 — TLS certificates valid and not expired
CONTROLLER MANAGER
[ ] 1.10 — Service account credentials rotated
[ ] 1.11 — RotateKubeletServerCertificate enabled
[ ] 1.12 — Service account private key file set
SCHEDULER
[ ] 1.13 — Profiling disabled (--profiling=false)
[ ] 1.14 — Bind address not set to 0.0.0.0
Step 3 — Worker Node Security
WORKER NODES (Section 2)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
KUBELET
[ ] 2.1 — Anonymous auth disabled on kubelet
[ ] 2.2 — Authorization mode not set to AlwaysAllow
[ ] 2.3 — Client CA file configured
[ ] 2.4 — Read-only port disabled (--read-only-port=0)
[ ] 2.5 — Streaming connection idle timeout configured
[ ] 2.6 — Protect kernel defaults enabled
[ ] 2.7 — RotateKubeletServerCertificate enabled
[ ] 2.8 — Hostname override not used (unless required)
FILE PERMISSIONS
[ ] 2.9 — Kubelet config file permissions: 644 or more restrictive
[ ] 2.10 — Kubelet config file ownership: root:root
[ ] 2.11 — PKI directory permissions: 755 or more restrictive
Step 4 — RBAC & Service Accounts
RBAC & SERVICE ACCOUNTS (Section 3)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 3.1 — cluster-admin role used sparingly
[ ] 3.2 — Minimize wildcard use in Roles and ClusterRoles
[ ] 3.3 — No default service account used for workloads
[ ] 3.4 — Service account token auto-mount disabled by default
[ ] 3.5 — No pods running with cluster-admin privileges
[ ] 3.6 — Audit RBAC bindings for over-permissioned accounts
[ ] 3.7 — Minimize use of privileged containers
Step 5 — Pod Security
POD SECURITY (Section 4)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 4.1 — Pod Security Standards enforced (Baseline minimum)
[ ] 4.2 — Privileged containers not allowed (except system)
[ ] 4.3 — hostPID and hostIPC not allowed
[ ] 4.4 — hostNetwork not allowed (except system pods)
[ ] 4.5 — Containers run as non-root (runAsNonRoot: true)
[ ] 4.6 — Root filesystem read-only where possible
[ ] 4.7 — NET_RAW capability dropped
[ ] 4.8 — Seccomp profile set (RuntimeDefault or custom)
[ ] 4.9 — Resource limits (CPU/memory) set for all containers
[ ] 4.10 — No containers mount Docker socket
Step 6 — Network Policies & Secrets
NETWORK & SECRETS (Section 5)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] 5.1 — NetworkPolicy defined for all namespaces
[ ] 5.2 — Default deny ingress policy per namespace
[ ] 5.3 — Default deny egress policy per namespace
[ ] 5.4 — Kubernetes secrets encrypted at rest (EncryptionConfiguration)
[ ] 5.5 — External secrets manager used (Vault, AWS SM, etc.)
[ ] 5.6 — No secrets in environment variables (use volumes)
[ ] 5.7 — Ingress/egress TLS termination configured
Step 7 — Scoring & Report
| CIS Section | Passed | Failed | N/A | Score |
|---|---|---|---|---|
| 1. Control Plane | X | Y | Z | % |
| 2. Worker Nodes | X | Y | Z | % |
| 3. RBAC | X | Y | Z | % |
| 4. Pod Security | X | Y | Z | % |
| 5. Network & Secrets | X | Y | Z | % |
| Overall | X | Y | Z | % |
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Produce a CIS Kubernetes Benchmark report with:
- Cluster metadata (name, version, distribution, node count)
- Per-section checklists with PASS/FAIL/N-A and remediation commands
- Score summary with per-section and overall percentages
- Critical findings requiring immediate attention
- Remediation runbook with kubectl/manifest patches for failed controls