# Kube Bench

> Use for Kubernetes CIS benchmark review during authorized pentests. Trigger on cluster hardening assessment, node and control-plane configuration review, and validating whether a Kubernetes environment meets baseline security expectations.

- Skill: `timsonner/kube-bench` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/kube-bench`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/kube-bench/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/kube-bench

---


# Kube-bench

## Purpose

Use this skill to compare an approved Kubernetes environment against benchmark-driven hardening expectations.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to review Kubernetes hardening against a known baseline.
- Need node or control-plane configuration findings tied to benchmark guidance.
- Need a repeatable hardening retest.

## Avoid When

- Cluster role or node access is unclear.
- The environment does not permit benchmark-style local review.

## Inputs

- Approved cluster role or node context
- Benchmark target and environment notes
- Output handling requirements

## Procedure

1. Confirm the cluster role and node scope.
2. Run only the checks relevant to the approved environment.
3. Triage results for material hardening gaps, not every benchmark difference.
4. Tie confirmed issues to realistic impact.
5. Preserve the exact benchmark scope for retest.

## Command Syntax

Replace sample roles with the approved environment context.

```bash
# Run all CIS Kubernetes benchmark checks
kube-bench

# Check master/control plane node
kube-bench run --targets master

# Check worker node
kube-bench run --targets node

# Check etcd
kube-bench run --targets etcd

# Specify CIS benchmark version
kube-bench --benchmark cis-1.8

# Output to JSON
kube-bench --json > contoso-kube-bench.json

# Run specific check by ID
kube-bench run --targets master --check 1.2.1
```

## Evidence to Capture

- Material hardening gaps tied to benchmark expectations
- Cluster role and node context used during review
- Retest deltas after remediation

## Safety Boundaries

- Use only within the approved cluster or node context.
- Treat benchmark output as a starting point for validation, not automatic final findings.