CKS — CIS Benchmarks & kube-bench
Chapter Overview
CIS Kubernetes Benchmarks are the industry-standard security configuration guidelines published by the Center for Internet Security. They define hundreds of checks across your control plane, worker nodes, and cluster policies — covering everything from API server flags to file permissions on etcd data directories.
kube-bench is the open-source tool (by Aqua Security) that automates these checks. It runs against your cluster nodes, compares the actual configuration to the CIS benchmark recommendations, and produces a detailed report of PASS, FAIL, WARN, and INFO results.
Together, CIS benchmarks and kube-bench give you a measurable security posture for your Kubernetes cluster. In the CKS exam, you’ll be expected to run kube-bench, interpret its output, and remediate FAIL results — often under time pressure on a live cluster.
CKS Exam Domain
| Property | Value |
|---|---|
| Domain | Domain 1 — Cluster Setup |
| Weight | 10% |
| Focus | CIS benchmark evaluation, kube-bench scanning, remediation of security misconfigurations |
| Exam Tasks | Run kube-bench, interpret PASS/FAIL results, fix failing checks on API server, kubelet, and etcd |
Strategy: CIS benchmark questions are highly predictable — the exam will ask you to run kube-bench, identify failures, and fix specific flags. If you’ve practiced the remediation workflows in this chapter, you can secure these points in under 10 minutes.
What You’ll Learn
| # | Topic | Description |
|---|---|---|
| 1 | Understanding CIS Benchmarks | What CIS benchmarks are, levels, scored vs not-scored, benchmark sections |
| 2 | kube-bench Setup | Install kube-bench (binary, container, Job), run scans, interpret output |
| 3 | Scanning Control Plane | Scan master nodes — API server, etcd, scheduler, controller-manager |
| 4 | Scanning Worker Nodes | Scan worker nodes — kubelet configuration, file permissions |
| 5 | Remediation Strategies | Fix top FAIL results, priority-based remediation, verification |
| 6 | Hands-On Lab | End-to-end lab: scan, identify, fix, verify |
How This Chapter Maps to the Exam
The CKS exam curriculum includes the following objective under Cluster Setup:
- Use CIS benchmark to review the security configuration of Kubernetes components (e.g., etcd, kubelet, kubedns, kubeapi)
This chapter covers the complete workflow:
- Understand what CIS benchmarks measure and why each check matters
- Scan using kube-bench against control plane and worker nodes
- Interpret output to distinguish critical failures from warnings
- Remediate by modifying component flags, file permissions, and configuration files
- Verify by re-running kube-bench to confirm fixes
Prerequisites
This chapter assumes you have:
- A working Kubernetes cluster with SSH access to nodes (kubeadm preferred)
- CKA-level proficiency with static Pod manifests in
/etc/kubernetes/manifests/ - Understanding of API server, etcd, scheduler, and controller-manager flags
- Familiarity with kubelet configuration (
/var/lib/kubelet/config.yaml) - Root or sudo access on cluster nodes
If any of these feel unfamiliar, revisit the CKA Tutorial before continuing.
Start Learning: Understanding CIS Benchmarks →
| ← Cluster Setup | Understanding CIS Benchmarks → |
