---
name: Kubernetes Cis Benchmark
slug: kubernetes-cis-benchmark
category: DevOps
description: Kubernetes Cis Benchmark runs kube-bench to assess a cluster against CIS controls and produce structured findings. Use it to prioritize remediation, retain evidence, and re-test fixes over time.
github: "https://github.com/devton/agentic-workflow-blueprint/tree/main/workflows/performing-kubernetes-cis-benchmark-with-kube-bench"
stars: 66
forks: 4
install: "npx degit https://github.com/devton/agentic-workflow-blueprint/tree/main/workflows/performing-kubernetes-cis-benchmark-with-kube-bench ~/.claude/skills/performing-kubernetes-cis-benchmark-with-kube-bench"
installs_to: ~/.claude/skills/performing-kubernetes-cis-benchmark-with-kube-bench
source_path: workflows/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md
collection_size: 26
category_size: 798
collection_url: "https://dirskills.com/collections/devton/agentic-workflow-blueprint"
added: 2026-08-12T04:44:05.624Z
last_synced: 2026-08-12T04:44:05.624Z
canonical_url: "https://dirskills.com/skills/kubernetes-cis-benchmark"
---

# Kubernetes Cis Benchmark

Kubernetes Cis Benchmark runs kube-bench to assess a cluster against CIS controls and produce structured findings. Use it to prioritize remediation, retain evidence, and re-test fixes over time.

**Install:**

```bash
npx degit https://github.com/devton/agentic-workflow-blueprint/tree/main/workflows/performing-kubernetes-cis-benchmark-with-kube-bench ~/.claude/skills/performing-kubernetes-cis-benchmark-with-kube-bench
```

## README

## agentic-workflows-blueprint.workflow.performing-kubernetes-cis-benchmark-with-kube-bench

### Goal

Assess Kubernetes cluster security posture against CIS benchmark controls using kube-bench and produce remediation-prioritized evidence for hardening programs.

### Scope

- Applies to: Kubernetes control plane, worker, etcd, and policy benchmark assessments.
- Does not cover: replacing runtime threat detection or policy enforcement controls.

### Triggers

- "Run Kubernetes CIS benchmark"
- "Assess cluster hardening with kube-bench"
- "Generate compliance evidence for Kubernetes security controls"
- "Track benchmark drift over time"

### Inputs

- `clusterContext`: cluster/provider/version context
- `benchmarkProfile`: target profile (generic, EKS, GKE, AKS, etc.)
- `executionMode`: node/binary run or Kubernetes job mode
- `severityPolicy`: mapping for FAIL/WARN prioritization
- `reportTarget` (optional): destination for JSON/JUnit/text output
- `remediationCapacity` (optional): team constraints for scheduled fixes

### Invariants

- Benchmark profile must match cluster platform/version context.
- Results must be preserved in machine-readable format for trend analysis.
- FAIL findings are prioritized before WARN findings unless justified.
- Remediation recommendations must map to specific CIS control IDs.

### Procedure

1. **Prepare benchmark run**
   - Select benchmark profile and execution mode.
   - Validate required permissions and host/cluster access.

2. **Execute kube-bench**
   - Run full benchmark and optionally component-specific targets.
   - Capture raw output and structured report formats.

3. **Classify findings**
   - Separate PASS/FAIL/WARN outcomes and map by benchmark section.
   - Identify high-risk controls affecting auth, API server, kubelet, and RBAC posture.

4. **Prioritize remediation**
   - Rank findings by security impact and operational risk.
   - Propose sequenced remediation plan with ownership and expected blast radius.

5. **Validate remediations**
   - Re-run impacted controls after configuration changes.
   - Confirm delta improvements and absence of regressions.

6. **Operationalize continuous assessment**
   - Schedule periodic benchmark runs for drift detection.
   - Publish trend metrics and unresolved findings backlog.

### Outputs

- kube-bench result artifacts (text/JSON/JUnit as configured).
- CIS findings summary with FAIL/WARN prioritization.
- Remediation plan mapped to control IDs.
- Re-test evidence for resolved controls.

### Review gate

- [ ] Benchmark profile aligns with platform/version.
- [ ] Structured report artifacts are generated and retained.
- [ ] FAIL findings have remediation owner and plan.
- [ ] Re-validation confirms critical fixes are effective.
- [ ] Continuous benchmark cadence is defined.

### References

- `../../SKILL.md`
- `../securing-kubernetes-on-cloud/SKILL.md`
- `../review/SKILL.md`
- [Interactive HTML View](./README.html)