Benchmarking Kubernetes With Kube Bench

What it does

When your agent uses it

• Setting kube-bench up for the first time
• Choosing which benchmark version and node targets to run
• Wiring it into CI
• Troubleshooting skipped

Example prompts

• “Use the benchmarking-kubernetes-with-kube-bench skill to install and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or…”
• “/benchmarking-kubernetes-with-kube-bench”

Requirements

• Python 3
• Docker

Workflow steps

8 steps, taken from the step headings in SKILL.md.

1. 1Run the default scan (auto-detect)
2. 2Run as a Kubernetes Job (in-cluster)
3. 3Target specific components
4. 4Pin a specific benchmark or Kubernetes version
5. 5Run or skip individual checks
6. 6Produce machine-readable output
7. 7Triage and remediate FAIL/WARN findings
8. 8Re-validate after remediation

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • kubectl
  • curl
  • go
  • docker

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com
  • raw.githubusercontent.com

  Also links to:

  • aquasecurity.github.io
  • cisecurity.org

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Benchmarking Kubernetes With Kube Bench loads about 2.3k tokens when it runs, and up to ~3.5k if it reads all its reference files. Until then it costs about 174 tokens; SKILL.md has 673 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~174

When it runs · the whole SKILL.md, loaded when a task matches

~2.3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:60

  sudo mv kube-bench /usr/local/bin/

• NoteRuns commands with sudoSKILL.md:61

  sudo cp -R cfg /etc/kube-bench/cfg

• NoteRuns commands with sudoSKILL.md:96

  sudo kube-bench

• NoteRuns commands with sudoSKILL.md:121

  sudo kube-bench run --targets master

• NoteRuns commands with sudoSKILL.md:124

  sudo kube-bench run --targets node

• NoteRuns commands with sudoSKILL.md:127

  sudo kube-bench run --targets etcd

• NoteRuns commands with sudoSKILL.md:130

  sudo kube-bench run --targets policies

• NoteRuns commands with sudoSKILL.md:133

  sudo kube-bench run --targets master,node,etcd,policies

• NoteRuns commands with sudoSKILL.md:142

  sudo kube-bench run --benchmark cis-1.8

• NoteRuns commands with sudoSKILL.md:145

  sudo kube-bench --version 1.27

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 673 words, ~2,328 tokens.

name

benchmarking-kubernetes-with-kube-bench

description

Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.

domain

cybersecurity

subdomain

container-security

tags

kubernetes, kube-bench, cis-benchmark, container-security, hardening, compliance, cluster-security

version

1.0

author

mahipal

license

Apache-2.0

nist_csf

PR.PS-01

mitre_attack

T1610

# Binary release (Linux)
KB_VERSION=0.10.7
curl -L -o kube-bench.tgz \
  "https://github.com/aquasecurity/kube-bench/releases/download/v${KB_VERSION}/kube-bench_${KB_VERSION}_linux_amd64.tar.gz"
tar -xzf kube-bench.tgz
sudo mv kube-bench /usr/local/bin/
sudo cp -R cfg /etc/kube-bench/cfg

# Via Go install
go install github.com/aquasecurity/kube-bench@latest

# Run as a one-off container directly on a node (mounts host config)
docker run --rm --pid=host \
  -v /etc:/etc:ro -v /var:/var:ro \
  -t docker.io/aquasec/kube-bench:latest run --targets node

# Verify
kube-bench version

sudo kube-bench

# General-purpose job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

# Wait, then retrieve results
kubectl get pods -l app=kube-bench
kubectl logs -l app=kube-bench

# Platform-specific jobs are available, e.g. EKS:
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-eks.yaml

# Control-plane (API server, scheduler, controller manager)
sudo kube-bench run --targets master

# Worker node (kubelet, proxy)
sudo kube-bench run --targets node

# etcd datastore
sudo kube-bench run --targets etcd

# Cluster-wide policies (RBAC, pod security, network policy)
sudo kube-bench run --targets policies

# Combine multiple targets
sudo kube-bench run --targets master,node,etcd,policies

# Pin to a specific CIS benchmark revision
sudo kube-bench run --benchmark cis-1.8

# Or map by Kubernetes version
sudo kube-bench --version 1.27

# Managed/distribution-specific benchmarks
sudo kube-bench run --benchmark eks-1.5.0
sudo kube-bench run --benchmark gke-1.6.0
sudo kube-bench run --benchmark rke2-cis-1.7

# Run only specific checks
sudo kube-bench run --targets master --check 1.2.1,1.2.2

# Skip noisy/known-accepted checks
sudo kube-bench run --targets node --skip 4.2.6

# JSON to a file
sudo kube-bench run --targets master,node --json --outputfile kube-bench-report.json

# JUnit (for CI test reporting)
sudo kube-bench --junit --outputfile kube-bench-junit.xml

# AWS Security Finding Format (for Security Hub)
sudo kube-bench run --targets node --asff

# Example remediation for a common control-plane FAIL:
# CIS 1.2.x — ensure anonymous-auth is disabled on the API server.
# Edit the static pod manifest and set the flag:
sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
#   - --anonymous-auth=false
# The kubelet restarts the static pod automatically.

# Example node remediation — kubelet config file permissions (CIS 4.1.x):
sudo chmod 600 /etc/kubernetes/kubelet/kubelet-config.json
sudo chown root:root /etc/kubernetes/kubelet/kubelet-config.json

sudo kube-bench run --targets master --check 1.2.1 --json --outputfile recheck.json

# Optional: persist results to PostgreSQL for trend tracking
sudo kube-bench run --targets master,node --pgsql

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/benchmarking-kubernetes-with-kube-bench of mukul975/Anthropic-Cybersecurity-Skills.

• SKILL.md
• LICENSE
• references/api-reference.md
• references/standards.md
• scripts/agent.py

Open the folder on GitHubat commit 54a7988