CIS Kubernetes Benchmark

This document introduces the CIS Kubernetes Benchmark, explains how to audit your compliance with the benchmark, and explains what Google Distributed Cloud (GDC) air-gapped configures when you cannot implement a recommendation yourself.

About the CIS benchmarks

The Center for Internet Security (CIS) releases benchmarks for best practice security recommendations. The CIS Kubernetes Benchmark provides a set of recommendations for configuring Kubernetes to support a strong security posture. The Benchmark is tied to a specific Kubernetes release. The CIS Kubernetes Benchmark is written for the open source Kubernetes distribution and intended to be as universally applicable across distributions as possible.

Access the benchmark

The CIS Kubernetes Benchmark is available on the CIS website .

Recommendation levels

The following table describes the recommendation levels in the CIS Kubernetes Benchmark.

Assessment status

An assessment status is included for every recommendation. The assessment status indicates whether the given recommendation can be automated or requires manual steps to implement. Both statuses are equally important and are determined and supported as defined in the following tables.

Versions

The assessment refers to the following versions:

Status of GDC air-gapped Kubernetes cluster

Audit benchmarks

Specific instructions for auditing each recommendation is available as part of the relevant CIS Benchmark. However, you might want to automate some of these checks to simplify the verification of these controls in your environment. The following tool can help with this.

Automated auditing of the CIS Kubernetes Benchmark

You can use an open-source tool kube-bench to test your cluster configuration against the CIS Kubernetes Benchmark.

Make sure to specify the appropriate version . For example:

 kube-bench  
--benchmark  
 BENCHMARK_VERSION 
 

Replace BENCHMARK_VERSION with the CIS Kubernetes Benchmark version you're using to assess your cluster.

To run specific CIS Benchmark sections, such as master, node, or etcd, use the run --targets command. For example:

 kube-bench  
run  
--targets  
master,node 

For more information, see kube-bench documentation on running kube-bench and commands and flags .