kube-bench

What it is

kube-bench is a CLI tool that checks whether a Kubernetes cluster is configured according to the CIS Kubernetes Benchmark. It runs as a Job or standalone binary on cluster nodes, inspects config files, running processes, and file permissions, then outputs pass/fail/warn results mapped to specific CIS control IDs. It doesn't fix anything — it's a read-only auditor. Category placement under "Provisioning" is a stretch; in practice this is a compliance/hardening tool, typically run post-provisioning or in CI as a gate.

Who builds it and why

Originally built and maintained by Aqua Security, now folded into their broader cloud-native security tooling lineage. The motivation is straightforward: CIS benchmarks are the de facto reference for "is this cluster configured safely," and most teams don't want to manually grep kubelet config files and audit policies against a 100+ page PDF. Aqua uses it as a top-of-funnel tool — free CIS scanning drives adoption of their paid runtime security and posture management products. 179 contributors and continued commits through mid-2026 indicate it's still actively maintained, not abandoned after acquisition.

Production readiness signal

Solid open-source signal: 8,091 stars, active commits as recent as June 2026, and a meaningful contributor base (179) suggest this isn't a side project on life support. Latest release v0.15.6 shows ongoing version discipline. CNCF maturity level is not publicly available — kube-bench is not a CNCF project itself, so don't expect a graduation badge; it's an Aqua-owned repo that happens to be widely used across the ecosystem, including in managed CIS scanning features from cloud providers and other security tools that shell out to it.

Who should use this

• Platform teams that need to prove CIS compliance for audits (SOC 2, FedRAMP, internal security review) and want a scriptable, offline way to generate evidence.
• Security engineers building custom CI/CD compliance gates who want raw pass/fail data they can pipe into their own reporting instead of a vendor dashboard.
• Anyone running self-managed Kubernetes (kubeadm, kops, on-prem) where you actually control kubelet configs, API server flags, and etcd — kube-bench's checks are most meaningful when you can act on the findings.
• Teams that want a free, no-signup baseline scan before evaluating paid posture management tools.

Who should NOT use this

• Teams on fully managed control planes (EKS, GKE, AKS) expecting full benchmark coverage — most control plane checks are inapplicable or unreachable since the cloud provider owns that layer; you'll get a lot of "not applicable" noise unless you use the vendor-specific CIS profile.
• Anyone expecting continuous drift detection or alerting. kube-bench is a point-in-time scanner, not a monitoring tool. No dashboard, no historical trending, no notifications out of the box.
• Teams wanting remediation automation. It tells you what's wrong, not how to safely fix it without breaking workloads — you own that risk.
• Organizations needing broader compliance frameworks (PCI-DSS, HIPAA mappings) or multi-cluster fleet-wide reporting without building that layer themselves.

Alternatives

• kubescape — broader scope than kube-bench: CIS benchmarks plus NSA/CISA hardening guides, RBAC analysis, and image scanning in one tool, with a UI.
• kube-hunter — complementary rather than substitute; it's a penetration-testing tool that actively probes for exploitable misconfigurations rather than auditing config files.
• Cloud-native CIS scanners (e.g., AWS Security Hub CIS checks, GKE Security Posture) — less portable, but zero setup if you're already on that platform and want native integration.

Pricing

Fully open source, Apache-2.0 licensed, free to use with no paid tier, no license gating, no usage limits. Aqua Security's commercial products (Aqua Platform) build on top of this concept but kube-bench itself has no monetized version.